Document

insert '' by 'CABRERA-ARTEGAGA'

Happy suggestion

JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER CABRERA-ARTEGAGA JAVIER

JAVIER CABRERA-ARTEAGA

Suggestions

CABRERA-ARTEGAGA

insert '' by 'JAVIER'

Happy suggestion

JAVIER CABRERA-ARTEAGA

Suggestions

JAVIER

for

replace 'for' by 'For'

Happy suggestion

For WebAssembly.

for WebAssembly

Suggestions

for

This sentence does not start with an uppercase letter.

Happy suggestion

for WebAssembly

insert '' by 'download'

Happy suggestion

Software is a tool that allows you to download and install software.

Software

Suggestions

download

allows

insert '' by 'that'

Happy suggestion

Software is a tool that allows you to download and install software.

Software

Suggestions

that

insert '' by 'tool'

Happy suggestion

Software is a tool that allows you to download and install software.

Software

Suggestions

tool

Collect

insert '' by 'Collectible'

Happy suggestion

al , ak” & KTH Nata §2 $8 OCH KONST %> o) Q Bios. Col

Suggestions

Collectible

Col

replace 'Col' by 'Collectible'

Happy suggestion

al , ak” & KTH Nata §2 $8 OCH KONST %> o) Q Bios. Col

Suggestions

Collectible

§2

2024

replace '2024' by '2024.'

Happy suggestion

Stockholm, Sweden, March 2024.

Stockholm, Sweden, March 2024

Suggestions

2024.

Javier

Abstract:

Diversification

replace 'Diversification' by 'diversification'

Happy suggestion

This work aims to harden the security within the WebAssembly ecosystem through the introduction of software diversification methods and tools. Software Diversification is a strategy designed to augment the costs of exploiting vulnerabilities by making software less predictable. The predictability within ecosystems can be diminished by automatically generating different, yet functionally equivalent, program variants. These variants strengthen observable properties that are typically used to launch attacks, and in many instances, can eliminate such vulnerabilities.

This work aims to harden the security within the WebAssembly ecosystem through the introduction of Software Diversification methods and tools. Software Diversification is a strategy designed to augment the costs of exploiting vulnerabilities by making software less predictable. The predictability within ecosystems can be diminished by automatically generating different, yet functionally equivalent, program variants. These variants strengthen observable properties that are typically used to launch attacks, and in many instances, can eliminate such vulnerabilities.

Suggestions

diversification

Software

replace 'Software' by 'software'

Happy suggestion

Suggestions

software

tools)

replace 'tools)' by 'tools:'

Keywords: WebAssembly, Software Diversification, Side-Channels.

Keywords: WebAssembly, Software Diversification, Side-Channels

Suggestions

Side-Channels.

Suggestions

officiallt

defensiv

replace 'defensiv' by 'defensive'

Happy suggestion

Detta arbete introducerar tre verktyg: CROW, MEWE och WASM-MUTATE. Varje verktyg har utformats specifikt for att hantera en unik aspekt av mjukvarudiversifiering. Vi presenterar empiriska bevis som visar pa potentialen for tillampning av vara metoder for mjukvarudiversifiering av WebAssembly-program pa tva distinkta satt: offensive och defensive mjukvarudiversifiering. Var forskning om offensive mjukvarudiversifiering i WebAssembly avsléjar potentialla vagar for att forbattra upptackten av WebAssembly-malware. A andra sidan visar vara experiment inom defensive mjukvarudiversifiering att WebAssembly-program kan hardas mot sidokanalattacker, sarskilt Spectre-attacken.

Detta arbete introducerar tre verktyg: CROW, MEWE och WASM-MUTATE. Varje verktyg har utformats specifikt for att hantera en unik aspekt av mjukvarudiversifiering. Vi presenterar empiriska bevis som visar pa potentialen for tillampning av vara metoder for mjukvarudiversifiering av WebAssembly-program pa tva distinkta satt: offensiv och defensiv mjukvarudiversifiering. Var forskning om offensiv mjukvarudiversifiering i WebAssembly avsléjar potentiella vagar for att forbattra upptackten av WebAssembly-malware. A andra sidan visar vara experiment inom defensiv mjukvarudiversifiering att WebAssembly-program kan hardas mot sidokanalattacker, sarskilt Spectre-attacken.

Suggestions

defensive

potentiella

replace 'potentiella' by 'potentialla'

Happy suggestion

Detta arbete introducerar tre verktyg: CROW, MEWE och WASM-MUTATE. Varje verktyg har utformats specifikt for att hantera en unik aspekt av mjukvarudiversifiering. Vi presenterar empiriska bevis som visar pa potentialen for tillampning av vara metoder for mjukvarudiversifiering av WebAssembly-program pa tva distinkta satt: offensiv och defensiv mjukvarudiversifiering. Var forskning om offensiv mjukvarudiversifiering i WebAssembly avsléjar potentiella vagar for att forbattra upptackten av WebAssembly-malware. A andra sidan visar vara experiment inom defensiv mjukvarudiversifiering att WebAssembly-program kan hardas mot sidokanalattacker, sarskilt Spectre-attacken.

Suggestions

potentialla

offensiv

replace 'offensiv' by 'offensive'

Happy suggestion

Detta arbete introducerar tre verktyg: CROW, MEWE och WASM-MUTATE. Varje verktyg har utformats specifikt for att hantera en unik aspekt av mjukvarudiversifiering. Vi presenterar empiriska bevis som visar pa potentialen for tillampning av vara metoder for mjukvarudiversifiering av WebAssembly-program pa tva distinkta satt: offensiv och defensiv mjukvarudiversifiering. Var forskning om offensiv mjukvarudiversifiering i WebAssembly avsléjar potentiella vagar for att forbattra upptackten av WebAssembly-malware. A andra sidan visar vara experiment inom defensiv mjukvarudiversifiering att WebAssembly-program kan hardas mot sidokanalattacker, sarskilt Spectre-attacken.

Suggestions

offensive

insert '' by '230'

Happy suggestion

4. Code Diversification for WebAssembly Javier Cabrera-Arteaga, Orestis Floros, Oscar Vera-Pérez, Benoit Baudry, Martin Monperrus Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb 2021), 12 pages https://doi.org/10.14722/madweb. 2021. 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 230

4. CROW: Code Diversification for WebAssembly Javier Cabrera-Arteaga, Orestis Floros, Oscar Vera-Pérez, Benoit Baudry, Martin Monperrus Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb 2021), 12 pages https://doi.org/10.14722/madweb. 2021. 23004

Suggestions

insert '' by '23004'

Happy suggestion

Suggestions

23004

2021.

replace '2021.' by '23004'

Happy suggestion

Suggestions

23004

https://doi.org/10.14722/madweb.

replace 'https://doi.org/10.14722/madweb.' by '23004'

Happy suggestion

Suggestions

23004

pages

replace 'pages' by '23004'

Happy suggestion

Suggestions

23004

replace '12' by '23004'

Happy suggestion

Suggestions

23004

2021),

replace '2021),' by '23004'

Happy suggestion

Suggestions

23004

(MADWeb

replace '(MADWeb' by '23004'

Happy suggestion

Suggestions

23004

Web

replace 'Web' by '23004'

Happy suggestion

Suggestions

23004

the

replace 'the' by '23004'

Happy suggestion

Suggestions

23004

for

replace 'for' by '23004'

Happy suggestion

Suggestions

23004

Defenses

replace 'Defenses' by '23004'

Happy suggestion

Suggestions

23004

and

replace 'and' by '23004'

Happy suggestion

Suggestions

23004

Attacks,

replace 'Attacks,' by '23004'

Happy suggestion

Suggestions

23004

Measurements,

replace 'Measurements,' by '23004'

Happy suggestion

Suggestions

23004

replace 'on' by '23004'

Happy suggestion

Suggestions

23004

Workshop

replace 'Workshop' by '23004'

Happy suggestion

Suggestions

23004

Martin

replace 'Martin' by '23004'

Happy suggestion

Suggestions

23004

Baudry,

replace 'Baudry,' by '23004'

Happy suggestion

Suggestions

23004

Benoit

replace 'Benoit' by '2021.'

Happy suggestion

Suggestions

2021.

Vera-Pérez,

replace 'Vera-Pérez,' by 'https://doi.org/10.14722/madweb.'

Happy suggestion

Suggestions

https://doi.org/10.14722/madweb.

Oscar

replace 'Oscar' by 'pages'

Happy suggestion

Suggestions

pages

Floros,

replace 'Floros,' by '12'

Suggestions

insert '' by 'Defenses'

Happy suggestion

Suggestions

Defenses

insert '' by 'and'

Happy suggestion

Suggestions

insert '' by 'Attacks,'

Happy suggestion

Suggestions

Attacks,

insert '' by 'Measurements,'

Happy suggestion

Suggestions

Measurements,

insert '' by 'on'

Happy suggestion

Suggestions

insert '' by 'Workshop'

Happy suggestion

Suggestions

Workshop

insert '' by 'Monperrus'

Happy suggestion

Suggestions

Monperrus

insert '' by 'Martin'

Happy suggestion

Suggestions

Martin

insert '' by 'Baudry,'

Happy suggestion

Suggestions

Baudry,

insert '' by 'Benoit'

Happy suggestion

Suggestions

Benoit

insert '' by 'Vera-Pérez,'

Happy suggestion

Suggestions

Vera-Pérez,

insert '' by 'Oscar'

Happy suggestion

Suggestions

Oscar

insert '' by 'Floros,'

Happy suggestion

Suggestions

Floros,

insert '' by 'Orestis'

Happy suggestion

Suggestions

Orestis

insert '' by 'Cabrera-Arteaga,'

Happy suggestion

Suggestions

Cabrera-Arteaga,

insert '' by 'Javier'

Happy suggestion

Suggestions

Javier

insert '' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

Diversification

replace 'Diversification' by 'for'

Happy suggestion

Suggestions

Code

replace 'Code' by 'Diversification'

Happy suggestion

Suggestions

Diversification

CROW:

replace 'CROW:' by 'Code'

Happy suggestion

Suggestions

Code

insert '' by '3564007)'

Happy suggestion

3. Multi-Variant Execution at the Edge Javier Cabrera-Arteaga, Pierre Laperdrix, Martin Monperrus, Benoit Baudry Workshop on Moving Target Defense (MTD 2022), 12 pages https://dl.acm.org/doi/abs/10.1145/3560828. 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007)

Suggestions

3564007)

insert '' by '-'

Happy suggestion

Suggestions

3564007

replace '3564007' by '3564007)'

Happy suggestion

Suggestions

3564007)

00324

delete '00324' by ''

Happy suggestion

2. Fast and Effective Binary Diversification for WebAssembly Javier Cabrera-Arteaga, Nicholas Fitzgerald, Martin Monperrus, Benoit Baudry Computers & Security, 2024, 20 pages https://www.sciencedirect.com/science/article/pii/S01674048240 00324.

2. WASM-MUTATE: Fast and Effective Binary Diversification for WebAssembly Javier Cabrera-Arteaga, Nicholas Fitzgerald, Martin Monperrus, Benoit Baudry Computers & Security, 2024, 20 pages https://www.sciencedirect.com/science/article/pii/S01674048240 00324

Suggestions

https://www.sciencedirect.com/science/article/pii/S01674048240

replace 'https://www.sciencedirect.com/science/article/pii/S01674048240' by '00324.'

Happy suggestion

Suggestions

00324.

pages

replace 'pages' by 'https://www.sciencedirect.com/science/article/pii/S01674048240'

Happy suggestion

Suggestions

https://www.sciencedirect.com/science/article/pii/S01674048240

replace '20' by 'pages'

Happy suggestion

Suggestions

pages

Security,

Computers

replace 'Computers' by '&'

WASM-MUTATE:

replace 'WASM-MUTATE:' by 'Fast'

Happy suggestion

Suggestions

Fast

02067

replace '02067' by '02067.'

Happy suggestion

1. WebAssembly Diversification for Malware Evasion Javier Cabrera-Arteaga, Tim Toady, Martin Monperrus, Benoit Baudry Computers & Security, Volume 131, 2028, 17 pages https://www.sciencedirect.com/science/article/pii/S01674048230 02067.

1. WebAssembly Diversification for Malware Evasion Javier Cabrera-Arteaga,Tim Toady, Martin Monperrus, Benoit Baudry Computers & Security, Volume 131, 2028, 17 pages https://www.sciencedirect.com/science/article/pii/S01674048230 02067

Suggestions

02067.

insert '' by 'Tim'

Happy suggestion

1. WebAssembly Diversification for Malware Evasion Javier Cabrera-Arteaga,Tim Toady, Martin Monperrus, Benoit Baudry Computers & Security, Volume 131, 2028, 17 pages https://www.sciencedirect.com/science/article/pii/S01674048230 02067

Suggestions

Cabrera-Arteaga,Tim

replace 'Cabrera-Arteaga,Tim' by 'Cabrera-Arteaga,'

Happy suggestion

1. WebAssembly Diversification for Malware Evasion Javier Cabrera-Arteaga,Tim Toady, Martin Monperrus, Benoit Baudry Computers & Security, Volume 131, 2028, 17 pages https://www.sciencedirect.com/science/article/pii/S01674048230 02067

Suggestions

Cabrera-Arteaga,

,Tim

Put a space after the comma.

Happy suggestion

1. WebAssembly Diversification for Malware Evasion Javier Cabrera-Arteaga,Tim Toady, Martin Monperrus, Benoit Baudry Computers & Security, Volume 131, 2028, 17 pages https://www.sciencedirect.com/science/article/pii/S01674048230 02067

Suggestions

, Tim

PAPERS

replace 'PAPERS' by 'PAPERS.'

Happy suggestion

LIST OF PAPERS.

LIST OF PAPERS

Suggestions

PAPERS.

https://doi.org/10.1145/3397537.3397567

replace 'https://doi.org/10.1145/3397537.3397567' by 'https://doi.org/10.1145/3397537.3397567.'

Happy suggestion

5. Superoptimization of WebAssembly Bytecode Javier Cabrera-Arteaga, Shrinish Donde, Jian Gu, Orestis Floros, Lucas Satabin, Benoit Baudry, Martin Monperrus Conference Companion of the 4th International Conference on Art, Science, and Engineering of Programming (Programming 2021), MoreVMs, 4 pages https://doi.org/10.1145/3397537.3397567.

Suggestions

https://doi.org/10.1145/3397537.3397567.

insert '' by 'all'

Happy suggestion

I would like to extend my gratitude to my supervisors, Benoit Baudry and Martin Monperrus. Their guidance has been a constant, ensuring that I never felt lost. Their support extended beyond professional advice, blossoming into a genuine friendship. There were times when I might have been challenging to work with, but I deeply appreciate your patience and willingness to listen - all that many histories about Cuba could be boring :) -Thank you, Benoit and Martin.

I would like to extend my gratitude to my supervisors, Benoit Baudry and Martin Monperrus. Their guidance has been a constant, ensuring that I never felt lost. Their support extended beyond professional advice, blossoming into a genuine friendship. There were times when I might have been challenging to work with, but I deeply appreciate your patience and willingness to listen -all that many histories about Cuba could be boring :) -Thank you, Benoit and Martin.

Suggestions

-all

replace '-all' by '-'

Happy suggestion

I would like to extend my gratitude to my supervisors, Benoit Baudry and Martin Monperrus. Their guidance has been a constant, ensuring that I never felt lost. Their support extended beyond professional advice, blossoming into a genuine friendship. There were times when I might have been challenging to work with, but I deeply appreciate your patience and willingness to listen -all that many histories about Cuba could be boring :) -Thank you, Benoit and Martin.

Suggestions

insert '' by 'an'

Happy suggestion

I want to thank the distinguished members of my jury. Professor Sukyoung Ryu, thanks for accepting to take the role of an opponent in my defense. Professor Dilian Gurov, thanks for taking the advance review of this work. Professors, Quentin Stiévenart, Bjorn De Sutter, and Weihang Wang, thank you all for being part of my grading committee and for your invaluable insights.

I want to thank the distinguished members of my jury. Professor Sukyoung Ryu, thanks for accepting to take the role of opponent in my defense. Professor Dilian Gurov, thanks for taking the advance review of this work. Professors, Quentin Stiévenart, Bjorn De Sutter, and Weihang Wang, thank you all for being part of my grading committee and for your invaluable insights.

Suggestions

immeasurably

delete 'immeasurably' by ''

Happy suggestion

Five years ago, relocating to Sweden for a Ph.D. Journey seemed unimaginable. At that time, I was grappling with the decision whether to advance my academic pursuits. During this phase of uncertainty, my mentor and friend, Oscar Luis Vera, presented a life-changing opportunity: a Ph.D. Position in Software Engineering at KTH. Now, as I look back over these past five years, I see a journey marked by challenges. Each step, no matter how difficult, has contributed immensely to my growth and learning. I carry with me a deep sense of accomplishment and no regrets—my heartfelt thanks to Oscar and Ali.

Five years ago, relocating to Sweden for a Ph.D. journey seemed unimaginable. At that time, I was grappling with the decision of whether to advance my academic pursuits. During this phase of uncertainty, my mentor and friend, Oscar Luis Vera, presented a life-changing opportunity: a Ph.D. position in Software Engineering at KTH. Now, as I look back over these past five years, I see a journey marked by challenges. Each step, no matter how difficult, has contributed immeasurably to my growth and learning. I carry with me a deep sense of accomplishment and no regrets—my heartfelt thanks to Oscar and Ali.

how

replace 'how' by 'difficult,'

Happy suggestion

Suggestions

difficult,

matter

replace 'matter' by 'how'

Happy suggestion

Suggestions

replace 'no' by 'matter'

Happy suggestion

Suggestions

matter

step,

replace 'step,' by 'no'

Happy suggestion

Suggestions

Each

replace 'Each' by 'step,'

Happy suggestion

Suggestions

step,

challenges.

replace 'challenges.' by 'Each'

Happy suggestion

Suggestions

Each

replace 'by' by 'challenges.'

Happy suggestion

Suggestions

challenges.

journey

see

replace 'see' by 'a'

Happy suggestion

Suggestions

replace 'I' by 'see'

Happy suggestion

Suggestions

years,

replace 'years,' by 'I'

Suggestions

back

replace 'I' by 'look'

Happy suggestion

Suggestions

look

Software

Ph.D.

life-changing

presented

replace 'presented' by 'a'

Suggestions

replace 'my' by 'mentor'

Happy suggestion

Suggestions

mentor

uncertainty,

replace 'uncertainty,' by 'my'

Happy suggestion

Suggestions

replace 'of' by 'uncertainty,'

Happy suggestion

Suggestions

uncertainty,

phase

replace 'phase' by 'of'

Suggestions

pursuits.

replace 'my' by 'academic'

Happy suggestion

Suggestions

academic

advance

replace 'advance' by 'my'

Happy suggestion

Suggestions

replace 'to' by 'advance'

Happy suggestion

Suggestions

advance

whether

replace 'whether' by 'to'

Happy suggestion

Suggestions

replace 'of' by 'whether'

Happy suggestion

Suggestions

whether

journey

replace 'journey' by 'Journey'

Happy suggestion

Suggestions

Journey

-this

replace '-this' by 'this'

Happy suggestion

First and foremost, to my beloved wife, Ilena, this journey has been yours as mine.

First and foremost, to my beloved wife, Ilena -this journey has been yours as mine.

Suggestions

this

Ilena

replace 'Ilena' by 'Ilena,'

Happy suggestion

First and foremost, to my beloved wife, Ilena, this journey has been yours as mine.

First and foremost, to my beloved wife, Ilena -this journey has been yours as mine.

Suggestions

Ilena,

insert '' by '(SSF)'

Happy suggestion

These last five years have been supported by the Stiftelsen for Strategisk Forskning (SSF) and the Trustfull project. I would like to thank all my colleagues in this project, especially Professor Musard Balliu for his invaluable insights.

These last five years have been supported by the Stiftelsen for Strategisk Forskning(SSF) and the Trustfull project. I would like to thank all my colleagues in this project, especially Professor Musard Balliu for his invaluable insights.

Suggestions

(SSF)

Forskning(SSF)

replace 'Forskning(SSF)' by 'Forskning'

Happy suggestion

These last five years have been supported by the Stiftelsen for Strategisk Forskning(SSF) and the Trustfull project. I would like to thank all my colleagues in this project, especially Professor Musard Balliu for his invaluable insights.

Suggestions

Forskning

Did you mean “me” or “my”?

Happy suggestion

Last but never least, to my family in Cuba, especially to “mi abuela Mary”. Family values led me to this successful journey.

Suggestions

outline

replace 'outline' by 'outline:'

Happy suggestion

Introduction 1.1 1.2 1.3 1.4 1.5 1.6 WebAssembly Predictability in WebAssembly ecosystems Problem statements Approach: Software Diversification Summary of research papers Thesis outline:

Introduction 1.1 1.2 1.3 1.4 1.5 1.6 WebAssembly Predictability in WebAssembly ecosystems Problem statements Approach: Software Diversification Summary of research papers Thesis outline

Suggestions

outline:

Thesis

replace 'Thesis' by 'thesis.'

Happy suggestion

I thesis.

I Thesis

Suggestions

thesis.

insert '' by 'Contents:'

Happy suggestion

Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents: Contents

Contents

Suggestions

Contents:

Papers

replace 'Papers' by 'Papers.'

Happy suggestion

List of Papers.

List of Papers

Suggestions

Papers.

Diversification

replace 'Diversification' by 'Divers'

Happy suggestion

Background and state of the art 2.1 WebAssembly 2.1.1 From source code to WebAssembly 2.1.2 WebAssembly’s binary format 2.1.3 WebAssembly’s runtime 2.1.4 WebAssembly’s control-flow 2.1.5 Security and reliability for WebAssembly 2.1.6 Open challenges 2.2 Software diversification 2.2.1 Automatic generation of software variants 2.2.2 Equivalence Checking 2.2.3 Variants deployment 2.2.4 Measuring Software Divers

Suggestions

Divers

Defensive

delete 'Defensive' by ''

Happy suggestion

Assessing Software Diversification for WebAssembly 4.1 4.1.1 4.1.2 4.1.3 4.2 4.2.1 4.2.2 4.2.3 4.3 Offensive Diversification: speculative side-channel protection Threat model: speculative side-channel attacks Methodology Results Conclusions

Assessing Software Diversification for WebAssembly 4.1 4.1.1 4.1.2 4.1.3 4.2 4.2.1 4.2.2 4.2.3 4.3 Offensive Diversification: Malware evasion Cryptojacking defense evasion Methodology Results Defensive Diversification: speculative side-channel protection Threat model: speculative side-channel attacks Methodology Results Conclusions

Automatic Software Diversification for WebAssembly 3.1 3.1.1 3.1.2 3.1.3 3.2 3.2.1 3.2.2 3.3 3.3.1 3.3.2 3.3.3 3.4.1 CROW: Code Randomization of WebAssembly Enumerative synthesis Constant inferring Exemplifying CROW MEWE: Multi-variant Execution for WebAssembly Multivariant call graph Exemplifying a Multivariant binary WASM-MUTATE: Fast and Effective Binary Diversification for WebAssembly WebAssembly Rewriting Rules E-Graph traversal Exemplifying WASM-MUTATE Comparing CROW, MEWE, and WASM-MUTATE Security applications

Suggestions

WebAssembl

Effective

replace 'Effective' by 'for'

Happy suggestion

Automatic Software Diversification for WebAssembly 3.1 3.1.1 3.1.2 3.1.3 3.2 3.2.1 3.2.2 3.3 3.3.1 3.3.2 3.3.3 3.4.1 CROW: Code Randomization of WebAssembly Enumerative synthesis Constant inferring Exemplifying CROW MEWE: Multi-variant Execution for WebAssembly Multivariant call graph Exemplifying a Multivariant binary WASM-MUTATE: Fast and Effective Binary Diversification for WebAssembly WebAssembly Rewriting Rules E-Graph traversal Exemplifying WASM-MUTATE Comparing CROW, MEWE, and WASM-MUTATE Security applications

Suggestions

Multivariant

WebAssembly WebAssembly

Possible typo: you repeated a word

Happy suggestion

Automatic Software Diversification for WebAssembly 3.1 3.1.1 3.1.2 3.1.3 3.2 3.2.1 3.2.2 3.3 3.3.1 3.3.2 3.3.3 3.4.1 CROW: Code Randomization of WebAssembly Enumerative synthesis Constant inferring Exemplifying CROW MEWE: Multi-variant Execution for WebAssembly Multivariant call graph Exemplifying a Multivariant binary WASM-MUTATE: Fast and Effective Binary Diversification for WebAssembly WebAssembly Rewriting Rules E-Graph traversal Exemplifying WASM-MUTATE Comparing CROW, MEWE, and WASM-MUTATE Security applications

Suggestions

WebAssembly

Diversification

replace 'Diversification' by 'diversification.'

Happy suggestion

2.2.5 Offensive or defensive assessment of diversification 2.3 Open challenges for software diversification.

2.2.5 Offensive or Defensive assessment of diversification 2.3 Open challenges for Software Diversification

Suggestions

diversification.

Software

replace 'Software' by 'software'

Happy suggestion

2.2.5 Offensive or defensive assessment of diversification 2.3 Open challenges for software diversification.

2.2.5 Offensive or Defensive assessment of diversification 2.3 Open challenges for Software Diversification

Suggestions

software

Defensive

replace 'Defensive' by 'defensive'

Happy suggestion

2.2.5 Offensive or defensive assessment of diversification 2.3 Open challenges for software diversification.

2.2.5 Offensive or Defensive assessment of diversification 2.3 Open challenges for Software Diversification

Suggestions

defensive

Diversification

replace 'Diversification' by 'Diversification.'

Happy suggestion

Conclusions and Future Work 5.1 5.2 5.3 5.3.1 5.3.2 5.3.3 Summary of technical contributions Key results of the thesis Future Work Data augmentation for Machine Learning on WebAssembly programs Improving WebAssembly malware detection via canonicalization Oneshot Diversification.

Suggestions

Diversification.

insert '' by '123'

Happy suggestion

123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123 123

123

Traces.

delete 'I' by ''

Happy suggestion

Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part I - Part

Part I

Suggestions

Part

insert '' by '-'

Happy suggestion

Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis - Thesis

Thesis

Suggestions

insert '' by 'Thesis'

Happy suggestion

Thesis

Suggestions

Thesis

-all

delete '-all' by ''

Happy suggestion

Jealous stepmother and sisters; magical aid by a beast; a marriage won by gifts magically provided; a bird revealing a secret; a recognition by aid of a ring; or what not; a denouement of punishment; a happy marriage - all those things, which in sequence, make up Cinderella, may and do occur in an incalculable number of other combinations.

Jealous stepmother and sisters; magical aid by a beast; a marriage won by gifts magically provided; a bird revealing a secret; a recognition by aid of a ring; or show; or what not; a dénouement of punishment; a happy marriage -all those things, which in sequence, make up Cinderella, may and do occur in an incalculable number of other combinations.

Suggestions

denouement

what

replace 'what' by 'a'

Happy suggestion

Suggestions

replace 'or' by 'not;'

Happy suggestion

Suggestions

not;

show;

replace 'show;' by 'what'

Happy suggestion

Suggestions

what

its

delete 'its' by ''

Happy suggestion

Inception, web browsing consisted solely of retrieving and displaying small, static text pages. With Nexus, users could access for the first time interlinked hypertext documents, so-called HTML pages. However, the escalating computing power of devices, the proliferation of the internet, the valuation of internet-based companies, and the demand for more engaging user experiences gave rise to the concept of executing code in conjunction with web pages. In 1995, the Netscape browser revolutionized this concept by introducing JavaScript [3], a programming language that allowed code execution on the client-side. Interactive web content immediately highlighted benefits: unlike classical native software, web applications do not require installation, are always up-to-date, and are accessible from any device with a web browser. Significantly, since the advent of Netscape, all browsers offer JavaScript support. In the present day, the majority of web pages incorporate not only HTML but also JavaScript code, which is executed on client computers. Consequently, over the past several decades, web browsers have evolved into intricate systems capable of running comprehensive applications, such as video and audio players, animation creators, and PDF document renderers. TT's first web browser, Nexus, made its appearance in 1990 [2]. At its best.

inception, web browsing consisted solely of retrieving and displaying small, static text pages. With Nexus, users could access for the first time interlinked hypertext documents, so-called HTML pages. However, the escalating computing power of devices, the proliferation of the internet, the valuation of internet-based companies, and the demand for more engaging user experiences gave rise to the concept of executing code in conjunction with web pages. In 1995, the Netscape browser revolutionized this concept by introducing JavaScript [3], a programming language that allowed code execution on the client-side. Interactive web content immediately highlighted benefits: unlike classical native software, web applications do not require installation, are always up-to-date, and are accessible from any device with a web browser. Significantly, since the advent of Netscape, all browsers offer JavaScript support. In the present day, the majority of web pages incorporate not only HTML but also JavaScript code, which is executed on client computers. Consequently, over the past several decades, web browsers have evolved into intricate systems capable of running comprehensive applications, such as video and audio players, animation creators, and PDF document renderers. TT first web browser, Nexus, made its appearance in 1990 [2]. At its

Suggestions

delete 'At' by ''

Happy suggestion

Suggestions

[2].

replace '[2].' by 'best.'

Happy suggestion

Suggestions

best.

1990

replace '1990' by 'its'

Happy suggestion

Suggestions

replace 'in' by 'At'

Suggestions

Nexus,

replace 'Nexus,' by 'appearance'

Happy suggestion

Suggestions

appearance

browser,

replace 'browser,' by 'its'

Happy suggestion

Suggestions

web

replace 'web' by 'made'

Happy suggestion

Suggestions

made

first

replace 'first' by 'Nexus,'

Happy suggestion

Suggestions

Nexus,

replace 'TT' by 'browser,'

Happy suggestion

Suggestions

browser,

renderers.

replace 'renderers.' by 'web'

Suggestions

players,

replace 'players,' by 'and'

Suggestions

players,

replace 'as' by 'audio'

Happy suggestion

Suggestions

audio

such

replace 'such' by 'and'

Happy suggestion

Suggestions

applications,

replace 'applications,' by 'video'

Happy suggestion

Suggestions

video

applications,

capable

replace 'capable' by 'comprehensive'

Happy suggestion

Suggestions

comprehensive

systems

replace 'systems' by 'running'

Happy suggestion

Suggestions

running

intricate

replace 'intricate' by 'of'

Consequently,

executed

replace 'executed' by 'computers.'

Happy suggestion

Suggestions

computers.

replace 'is' by 'client'

Happy suggestion

Suggestions

client

which

replace 'which' by 'on'

Happy suggestion

Suggestions

code,

replace 'code,' by 'executed'

Happy suggestion

Suggestions

executed

JavaScript

replace 'JavaScript' by 'is'

replace 'of' by 'incorporate'

Happy suggestion

Suggestions

incorporate

majority

replace 'majority' by 'pages'

Happy suggestion

Suggestions

pages

day,

JavaScript

replace 'JavaScript' by 'present'

Happy suggestion

Suggestions

present

support.

Netscape,

replace 'Netscape,' by 'JavaScript'

Happy suggestion

Suggestions

JavaScript

replace 'of' by 'offer'

Happy suggestion

Suggestions

offer

advent

replace 'advent' by 'browsers'

Happy suggestion

Suggestions

browsers

the

replace 'the' by 'all'

Happy suggestion

Suggestions

since

replace 'since' by 'Netscape,'

Happy suggestion

Suggestions

Netscape,

Significantly,

replace 'Significantly,' by 'of'

Happy suggestion

Suggestions

browser.

replace 'browser.' by 'advent'

Happy suggestion

Suggestions

advent

web

replace 'web' by 'the'

Happy suggestion

Suggestions

replace 'a' by 'since'

Happy suggestion

Suggestions

since

with

replace 'with' by 'Significantly,'

Happy suggestion

Suggestions

Significantly,

device

replace 'device' by 'browser.'

Happy suggestion

Suggestions

browser.

with

are

replace 'are' by 'device'

Happy suggestion

Suggestions

device

and

replace 'and' by 'any'

replace 'do' by 'up-to-date,'

Happy suggestion

Suggestions

up-to-date,

applications

replace 'applications' by 'always'

Happy suggestion

Suggestions

always

web

replace 'web' by 'are'

applications

highlighted

replace 'highlighted' by 'web'

Suggestions

highlighted

replace 'on' by 'immediately'

Happy suggestion

Suggestions

immediately

execution

replace 'execution' by 'content'

Happy suggestion

Suggestions

content

code

replace 'code' by 'web'

replace 'JavaScript' by 'allowed'

Happy suggestion

Suggestions

allowed

introducing

replace 'introducing' by 'that'

Happy suggestion

Suggestions

that

replace 'by' by 'language'

Happy suggestion

Suggestions

language

concept

replace 'concept' by 'programming'

Happy suggestion

Suggestions

programming

this

replace 'this' by 'a'

this

pages.

replace 'pages.' by 'revolutionized'

Happy suggestion

Suggestions

revolutionized

web

replace 'web' by 'browser'

Happy suggestion

Suggestions

browser

with

replace 'with' by 'Netscape'

Happy suggestion

Suggestions

Netscape

conjunction

replace 'conjunction' by 'the'

Happy suggestion

Suggestions

replace 'in' by '1995,'

Happy suggestion

Suggestions

1995,

with

code

gave

replace 'gave' by 'executing'

Happy suggestion

Suggestions

executing

experiences

replace 'experiences' by 'of'

Happy suggestion

Suggestions

user

replace 'user' by 'concept'

Happy suggestion

Suggestions

concept

engaging

replace 'engaging' by 'the'

Happy suggestion

Suggestions

replace 'more' by 'to'

Suggestions

the

replace 'the' by 'internet-based'

Happy suggestion

Suggestions

internet-based

proliferation

replace 'proliferation' by 'valuation'

Happy suggestion

Suggestions

valuation

insert '' by 'internet,'

Happy suggestion

Suggestions

internet,

devices,

replace 'devices,' by 'the'

Happy suggestion

Suggestions

insert '' by 'proliferation'

Happy suggestion

Suggestions

proliferation

insert '' by 'the'

Happy suggestion

Suggestions

insert '' by 'devices,'

Happy suggestion

Suggestions

devices,

insert '' by 'of'

Happy suggestion

Suggestions

inception,

replace 'inception,' by 'Inception,'

Happy suggestion

Suggestions

Inception,

inception

This sentence does not start with an uppercase letter.

Happy suggestion

Suggestions

Inception

side?.

replace 'side?.' by 'side?'

Happy suggestion

Despite being the main scripting language in modern web browsers, JavaScript has limitations due to its unique language characteristics [4]. Each JavaScript engine requires the parsing and recompiling of the JavaScript code, thereby causing substantial overhead. In practice, the process of parsing and compiling JavaScript code constitutes the majority of website load times. Additionally, JavaScript presents security issues, including the lack of memory isolation, which potentially enables information extraction from other processes [5, 6]. Numerous attempts have been made to port other languages, offering different guarantees, to the browser execution as alternatives to JavaScript. For instance, Java applets emerged on web pages in the late 90s, enabling the execution of Java bytecode on the client side? Likewise, Microsoft proposed ActiveX in 1996°, and Silverlight in 2007*. However, these attempts either failed to persist or experienced low adoption, primarily due to security issues and the absence of consensus among the community of browser vendors.

Despite being the main scripting language in modern web browsers, JavaScript has limitations due to its unique language characteristics [4]. Each JavaScript engine requires the parsing and recompiling of the JavaScript code, thereby causing substantial overhead. In practice, the process of parsing and compiling JavaScript code constitutes the majority of website load times. Additionally, JavaScript presents security issues, including the lack of memory isolation, which potentially enables information extraction from other processes [5, 6]. Numerous attempts have been made to port other languages, offering different guarantees, to the browser execution as alternatives to JavaScript. For instance, Java applets emerged on web pages in the late 90s, enabling the execution of Java bytecode on the client side?. Likewise, Microsoft proposed ActiveX in 1996°, and Silverlight in 2007*. However, these attempts either failed to persist or experienced low adoption, primarily due to security issues and the absence of consensus among the community of browser vendors.

Suggestions

side?

“nttps://www.microsoft.com/silverlight/

replace '“nttps://www.microsoft.com/silverlight/' by '“nttps://www.microsoft.com/silverlight/.'

Happy suggestion

lhttps://hacks.mozilla.org/2017/02/what-makes-webassembly-fast *https://www.oracle.com/java/technologies/javase/9-deprecated-features. html 3https://web. Archive. org/web/20090828024117/http://www.microsoft.com/presspass/pr ess/1996/mar96/activxpr.mspx “nttps://www.microsoft.com/silverlight/.

lhttps://hacks.mozilla.org/2017/02/what-makes-webassembly-fast *https://www.oracle.com/java/technologies/javase/9-deprecated-features. html 3https://web. archive. org/web/20090828024117/http://www.microsoft.com/presspass/pr ess/1996/mar96/activxpr.mspx “nttps://www.microsoft.com/silverlight/

Suggestions

“nttps://www.microsoft.com/silverlight/.

archive.

replace 'archive.' by 'Archive.'

Happy suggestion

lhttps://hacks.mozilla.org/2017/02/what-makes-webassembly-fast *https://www.oracle.com/java/technologies/javase/9-deprecated-features. html 3https://web. archive. org/web/20090828024117/http://www.microsoft.com/presspass/pr ess/1996/mar96/activxpr.mspx “nttps://www.microsoft.com/silverlight/

Suggestions

Archive.

lhttps

This sentence does not start with an uppercase letter.

Happy suggestion

lhttps://hacks.mozilla.org/2017/02/what-makes-webassembly-fast *https://www.oracle.com/java/technologies/javase/9-deprecated-features. html 3https://web. archive. org/web/20090828024117/http://www.microsoft.com/presspass/pr ess/1996/mar96/activxpr.mspx “nttps://www.microsoft.com/silverlight/

Suggestions

Lhttps

WebAssembly?.

replace 'WebAssembly?.' by 'WebAssembly?'

Happy suggestion

Importantly, WebAssembly provides a platform for compiling several legacy code applications, like those written in C/C++. For example, LLVM includes WebAssembly as a backend since release 7.1.0 published in May 2019%. WebAssembly paves the way for web applications to undertake roles traditionally reserved for native desktop applications, having the potential to transform web software as we know it. For example, applications such as AutoCAD and Adobe Photoshop have been ported to WebAssembly?

Suggestions

WebAssembly?

delete 'to' by ''

Happy suggestion

The first distinction from earlier attempts to port non-JavaScript languages to the web lies in WebAssembly’s initial design. Unlike its predecessors, WebAssembly was crafted to supplement JavaScript in the browser as a platform-agnostic, low-level bytecode, rather than completely replace it. Its primary goal was to replace computing-intensive JavaScript code in contemporary web applications. Additionally, WebAssembly is the inaugural major language that used formal specification and verification right from the design inception [7, 8].

The first distinction from earlier attempts to port non-JavaScript languages to the web lies in WebAssembly’s initial design. Unlike its predecessors, WebAssembly was crafted to supplement JavaScript in the browser as a platform-agnostic, low-level bytecode, rather than to completely replace it. Its primary goal was to replace computing-intensive JavaScript code in contemporary web applications. Additionally, WebAssembly is the inaugural major language that used formal specification and verification right from the design inception [7, 8].

Suggestions

the

delete 'the' by ''

Happy suggestion

Importantly, in 2014, Alon Zakai et al. The Emscripten tool®. Emscripten employs a strict subset of JavaScript, asm.js, to facilitate the compilation of low-level code such as C to JavaScript. Asm.js was included as an LLVM backend®. This strategy offered the advantages of the ahead-of-time optimizations from LLVM, resulting in performance gains on browser clients’ when compared to standard JavaScript code. Asm.js outperformed JavaScript because it restricted language features to those that could be optimized in the LLVM pipeline. Moreover, it eliminated most of the language’s dynamic characteristics, limiting it to numerical types, top-level functions, and one large array in memory accessed directly as raw data. Asm.js proved that client-side code could be enhanced with the appropriate language design and standardization. In response to persistent JavaScript-related issues, the formalization and creation of a formal specification following asm.js laid the groundwork for the emergence of WebAssembly as a fast, low-level, portable bytecode for browsers. In 2015, the Web Consortium (W3C) standardized WebAssembly. As a result, WebAssembly bytecode became the fourth official language for the web.

Importantly, in 2014, Alon Zakai et al. proposed the Emscripten tool®. Emscripten employs a strict subset of JavaScript, asm.js, to facilitate the compilation of low-level code such as C to JavaScript. Asm.js was included as an LLVM backend®. This strategy offered the advantages of the ahead-of-time optimizations from LLVM, resulting in performance gains on browser clients’ when compared to standard JavaScript code. Asm.js outperformed JavaScript because it restricted language features to those that could be optimized in the LLVM pipeline. Moreover, it eliminated most of the language’s dynamic characteristics, limiting it to numerical types, top-level functions, and one large array in memory accessed directly as raw data. Asm.js proved that client-side code could be enhanced with the appropriate language design and standardization. In response to persistent JavaScript-related issues, the formalization and creation of a formal specification following asm.js laid the groundwork for the emergence of WebAssembly as a fast, low-level, portable bytecode for browsers. In 2015, the Web Consortium (W3C) standardized WebAssembly. As a result, WebAssembly bytecode became the fourth official language for the web.

Suggestions

proposed

replace 'proposed' by 'The'

Happy suggestion

Suggestions

9lw

delete '9lw' by ''

Happy suggestion

“https://emscripten.org/ Shttp://asmjs.org/spec/latest/ “https://hacks.mozilla.org/2015/03/asm-speedups-everywhere/ Shttps://github.com/11vm/1lvm-project/releases/tag/llvmorg-7.1.0 Snttps://twitter.com/Adobe/status/14530348050046853137

Suggestions

1N7-WmzecAOK4V8R6

delete '1N7-WmzecAOK4V8R6' by ''

Happy suggestion

Suggestions

Snttps://twitter.com/Adobe/status/14530348050046853137s=20&t=Zf

replace 'Snttps://twitter.com/Adobe/status/14530348050046853137s=20&t=Zf' by 'Snttps://twitter.com/Adobe/status/14530348050046853137'

Happy suggestion

Suggestions

Snttps://twitter.com/Adobe/status/14530348050046853137

and,

replace 'and,' by 'and'

Happy suggestion

The extensive applicability and rapid adoption of WebAssembly have prompted requests for additional features. However, these demands do not always align with the initial specifications. For extending WebAssembly with a new proposal, it must satisfy particular criteria. A new proposal needs a formal specification and at least two implementations, e.g., two different WebAssembly engines. This approach allows for swift incorporation of new formalization and features via the so-called “evergreen method” while maintaining the original WebAssembly specification intact. Since the inception of WebAssembly, numerous extensions have been proposed for standardization. For instance, the SIMD proposal enables the execution of vectorized instructions in WebAssembly. After approval, new extensions remain optional, ensuring that the core WebAssembly version remains 1.0. The ongoing development of WebAssembly provides avenues for research and development. However, it also gives rise to security concerns within the ecosystem, as new threats emerge.

The extensive applicability and rapid adoption of WebAssembly have prompted requests for additional features. However, these demands do not always align with the initial specifications. For extending WebAssembly with a new proposal, it must satisfy particular criteria. A new proposal needs a formal specification and, at least two implementations, e.g., two different WebAssembly engines. This approach allows for swift incorporation of new formalization and features via the so-called “evergreen method” while maintaining the original WebAssembly specification intact. Since the inception of WebAssembly, numerous extensions have been proposed for standardization. For instance, the SIMD proposal enables the execution of vectorized instructions in WebAssembly. After approval, new extensions remain optional, ensuring that the core WebAssembly version remains 1.0. The ongoing development of WebAssembly provides avenues for research and development. However, it also gives rise to security concerns within the ecosystem, as new threats emerge.

l0ntps:

l0nttps

Possible typo detected.

Happy suggestion

l0nttps: //github.com/WebAssembly/WASI

Suggestions

lattes
HTTPS
letups
NTPs

attack!!.

replace 'attack!!.' by 'attack!!'

Happy suggestion

The above issue is exacerbated when considering the adoption of WebAssembly by edge-cloud computing platforms to provide services. In addition to browser clients, thousands of edge devices operate millions of identical WebAssembly instantiations per second [17]. This suggests that a single vulnerable WebAssembly binary in an edge network node could render every node identically susceptible due to the binary replication occurring on each node. A potential attacker could compromise all edge nodes concurrently, implying that a single distributed WebAssembly binary could trigger a global attack!!

The aforementioned issue is exacerbated when considering the adoption of WebAssembly by edge-cloud computing platforms to provide services. In addition to browser clients, thousands of edge devices operate millions of identical WebAssembly instantiations per second [17]. This suggests that a single vulnerable WebAssembly binary in an edge network node could render every node identically susceptible due to the binary replication occurring on each node. A potential attacker could compromise all edge nodes concurrently, implying that a single distributed WebAssembly binary could trigger a global attack!!.

Suggestions

attack!!

aforementioned

replace 'aforementioned' by 'above'

Happy suggestion

Suggestions

above

ecosystems

replace 'ecosystems' by 'ecosystems.'

Happy suggestion

Predictability in WebAssembly ecosystems.

Predictability in WebAssembly ecosystems

Suggestions

ecosystems.

l1nttps

Possible typo detected.

Happy suggestion

l1nttps://www.fastly.com/blog/defense-in-depth-stopping-a-wasm-compiler-bug-befo re-it-became-a-problem

Suggestions

lattes
HTTPS
letups
NTPs

the

delete 'the' by ''

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. The potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. The possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

demonstrated

delete 'demonstrated' by ''

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

al.

replace 'al.' by 'The'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Genkin

standalone

replace 'standalone' by 'deployments,'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

deployments,

replace 'In' by 'standalone'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

standalone

[21].

replace '[21].' by 'In'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

unnoticed

replace 'unnoticed' by 'overflows'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

overflows

replace 'in' by 'unnoticed'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

unnoticed

result

replace 'result' by 'in'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

protections

replace 'of' by 'stack-smashing'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

stack-smashing

lack

replace 'lack' by 'of'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

the

replace 'the' by 'lack'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

lack

Besides,

replace 'Besides,' by 'the'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

binaries

replace 'binaries' by 'due'

Suggestions

can

replace 'can' by 'exist'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

exist

innate

[19,

are

replace 'are' by 'feasible'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

feasible

itself

replace 'itself' by 'are'

Suggestions

the

replace 'the' by 'memory'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

memory

within

replace 'within' by 'the'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

which

replace 'which' by 'are'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

cases,

replace 'In' by 'such'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

such

browsers

malware

replace 'malware' by 'in'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

contention

replace 'of' by 'port'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Suggestions

port

risk

replace 'risk' by 'of'

Happy suggestion

We devise two scenarios where predictability affects WebAssembly ecosystems. First, the predictability of execution engines and WebAssembly binaries themselves facilitates side-channel and memory attacks. Despite the praise for WebAssembly’s security, particularly its design that prohibits programs from accessing data beyond their own memory, it is not immune to such vulnerabilities. For example, Rokicki et al. highlighted the potential risk of port contention side-channel attacks using WebAssembly malware in browsers [18]. In such cases, mitigations often involve hardware and operating-level changes, which are not always feasible. Moreover, attacks within the memory of WebAssembly itself are feasible [19, 20] as innate vulnerabilities can exist in WebAssembly binaries due to flaws in the source code. Besides, the lack of stack-smashing protections could result in unnoticed overflows and crashes during WebAssembly executions [21]. In standalone deployments, Genkin et al. demonstrated the possibility of data extraction via cache-timing side channels in WebAssembly [22]. In a similar vein, Maisuradze and Rossow exhibited speculative execution attacks on WebAssembly binaries [23].

Diversification

replace 'Diversification' by 'Diversification.'

Happy suggestion

Approach: Software Diversification.

Approach: Software Diversification

Suggestions

Diversification.

pose

replace 'pose' by 'poses'

Happy suggestion

To sum up, predictability and potential vulnerabilities form a harmful combination. This principle does not exclude WebAssembly and its ecosystem. The effect of exploiting a single vulnerability in WebAssembly could prove catastrophic, given that all devices running the same WebAssembly binaries could be affected. On the other hand, WebAssembly malware poses a severe threat. Present defenses may not adequately protect against them, as they have not been designed to manage situations outside predictable scenarios, such as obfuscation. Besides, mitigations might require hardware and operating-level changes, which are not always feasible. In this dissertation, we tackle the subsequent two problems:

To sum up, predictability and potential vulnerabilities form a harmful combination. This principle does not exclude WebAssembly and its ecosystem. The effect of exploiting a single vulnerability in WebAssembly could prove catastrophic, given all devices running the same WebAssembly binaries could be affected. On the other hand, WebAssembly malware pose a severe threat. Present defenses may not adequately protect against them, as they have not been designed to manage situations outside predictable scenarios, such as obfuscation. Besides, mitigations might require hardware and operating-level changes, which are not always feasible. In this dissertation, we tackle the subsequent two problems:

Suggestions

poses

insert '' by 'that'

Happy suggestion

To sum up, predictability and potential vulnerabilities form a harmful combination. This principle does not exclude WebAssembly and its ecosystem. The effect of exploiting a single vulnerability in WebAssembly could prove catastrophic, given all devices running the same WebAssembly binaries could be affected. On the other hand, WebAssembly malware pose a severe threat. Present defenses may not adequately protect against them, as they have not been designed to manage situations outside predictable scenarios, such as obfuscation. Besides, mitigations might require hardware and operating-level changes, which are not always feasible. In this dissertation, we tackle the subsequent two problems:

Suggestions

that

statements

replace 'statements' by 'Statements.'

Happy suggestion

Problem Statements.

Problem statements

Suggestions

Statements.

enunciated

replace 'enunciated' by 'enumerated'

Happy suggestion

This dissertation introduces tools, strategies, and methodologies designed to address the previously enumerated problems via Software Diversification. Software Diversification is a security strategy that involves identifying, developing, and deploying program variants of a given original program [32]. Pioneers in this field, Cohen et al. [33] and Forrest et al. [34], proposed enhancing software diversity through code transformations. Their proposal recommended the creation of diverse program variants, maintaining their original functionalities. Software Diversification aims to lessen potential vulnerabilities by enhancing behavior unpredictability in observabilities used to conduct attacks, e.g., side-channels.

This dissertation introduces tools, strategies, and methodologies designed to address the previously enunciated problems via Software Diversification. Software Diversification is a security strategy that involves identifying, developing, and deploying program variants of a given original program [32]. Pioneers in this field, Cohen et al. [33] and Forrest et al. [34], proposed enhancing software diversity through code transformations. Their proposal recommended the creation of diverse program variants, maintaining their original functionalities. Software Diversification aims to lessen potential vulnerabilities by enhancing behavior unpredictability in observabilities used to conduct attacks, e.g., side-channels.

Suggestions

enumerated

usage

delete 'usage' by ''

Happy suggestion

In order to address P1, we assess how diversified WebAssembly program variants could be used for defensive purposes. We provide empirical insights about the practical use of the generated variants in preventing attacks.

C2 Defensive Diversification Technique: In order to address P1, we assess how diversified WebAssembly program variants could be used for defensive purposes. We provide empirical insights about the practical usage of the generated variants in preventing attacks.

Suggestions

practical

provide

replace 'provide' by 'the'

Happy suggestion

Suggestions

replace 'We' by 'about'

Happy suggestion

Suggestions

about

purposes.

replace 'purposes.' by 'insights'

Happy suggestion

Suggestions

insights

defensive

replace 'defensive' by 'empirical'

Happy suggestion

Suggestions

empirical

for

replace 'for' by 'provide'

Happy suggestion

Suggestions

provide

used

replace 'used' by 'We'

Happy suggestion

Suggestions

replace 'be' by 'purposes.'

Happy suggestion

Suggestions

purposes.

could

replace 'could' by 'defensive'

Happy suggestion

Suggestions

defensive

variants

replace 'variants' by 'for'

Suggestions

program

replace 'we' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

P1,

replace 'P1,' by 'diversified'

Happy suggestion

Suggestions

diversified

address

replace 'address' by 'how'

Happy suggestion

Suggestions

replace 'to' by 'assess'

Happy suggestion

Suggestions

assess

order

replace 'order' by 'we'

Happy suggestion

Suggestions

replace 'In' by 'P1,'

Happy suggestion

Suggestions

Technique:

replace 'Technique:' by 'address'

Happy suggestion

Suggestions

address

C1 Offensive Diversification Technique: In order to address P2, we evaluate the potential for using generated WebAssembly program variants for offensive purposes. Our research includes experiments where we test the resilience of WebAssembly analysis tools against these generated variants. Furthermore, we offer insights into which types of program variants practitioners should prioritize to improve WebAssembly analysis tools.

insert '' by '[35].'

Suggestions

benefits

[35]

replace '[35]' by 'practical'

Happy suggestion

Suggestions

practical

diversification

replace 'diversification' by 'the'

Happy suggestion

Suggestions

replace 'of' by 'underscored'

Happy suggestion

Suggestions

underscored

benefits

replace 'benefits' by 'he'

Happy suggestion

Suggestions

practical

replace 'practical' by '1989,'

Happy suggestion

Suggestions

1989,

the

Suggestions

replace 'w~' by 'w'

Happy suggestion

Contribution Research papers I Wt m tv [36] [37] [38] [39] C1 Offensive diversification technique w C2 Defensive diversification technique | WY WW C3 Extensive experimental evaluation | WY WY WY WW

Suggestions

technique

delete 'technique' by ''

Happy suggestion

For each proposed technique, we provide an artifact implementation and conduct experiments to assess its capabilities. The artifacts are publicly available. The protocols and results of assessing the artifacts provide guidance for future research on P1 and P2.

C3 Extensive experimental evaluation: For each proposed technique we provide an artifact implementation and conduct experiments to assess its capabilities. The artifacts are publicly available. The protocols and results of assessing the artifacts provide guidance for future research on P1 and P2.

Suggestions

technique,

experimental

replace 'experimental' by 'proposed'

Happy suggestion

Suggestions

proposed

Extensive

replace 'Extensive' by 'each'

Happy suggestion

Suggestions

each

replace 'C3' by 'For'

Happy suggestion

Suggestions

insert '' by '3564007)'

Happy suggestion

II: Multivariant execution at the Edge. Javier Cabrera-Arteaga, Pierre Laperdrix, Martin Monperrus, Benoit Baudry Workshop on Moving Target Defense (MTD 2022), 12 pages https://dl.acm.org/doi/abs/10.1145/3560828. 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007) - 3564007)

Suggestions

3564007)

insert '' by '-'

Happy suggestion

Suggestions

3564007

replace '3564007' by '3564007)'

Happy suggestion

Suggestions

3564007)

Summary:

replace 'Summary:' by 'Summary'

Happy suggestion

Summary In this paper, we introduce the first entirely automated workflow for diversifying WebAssembly binaries. We present CROW, an open-source tool that implements Software Diversification through enumerative synthesis. We assess the capabilities of CROW and examine its application on real-world, security-sensitive programs. In general, CROW can create thousands of statically diverse variants. Furthermore, we illustrate that the generated variants exhibit different behaviors at runtime.

Summary: In this paper, we introduce the first entirely automated workflow for diversifying WebAssembly binaries. We present CROW, an open-source tool that implements Software Diversification through enumerative synthesis. We assess the capabilities of CROW and examine its application on real-world, security-sensitive programs. In general, CROW can create thousands of statically diverse variants. Furthermore, we illustrate that the generated variants exhibit different behaviors at runtime.

Suggestions

Summary

insert '' by '230'

Happy suggestion

CROW: Code randomization for WebAssembly bytecode. Javier Cabrera-Arteaga, Orestis Floros, Oscar Vera-Pérez, Benoit Baudry, Martin Monperrus Workshop on Measurements Measurements, Attacks, and Defenses for the Web (MADWeb 2021), 12 pages https://doi.org/10.14722/madweb. 2021. 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 23004 230

I: CROW: Code randomization for WebAssembly bytecode. Javier Cabrera-Arteaga, Orestis Floros, Oscar Vera-Pérez, Benoit Baudry, Martin Monperrus Workshop on Measurements Measurements, Attacks, and Defenses for the Web (MADWeb 2021), 12 pages https://doi.org/10.14722/madweb. 2021. 23004

Suggestions

insert '' by '23004'

Happy suggestion

Suggestions

23004

2021.

replace '2021.' by '23004'

Happy suggestion

Suggestions

23004

https://doi.org/10.14722/madweb.

replace 'https://doi.org/10.14722/madweb.' by '23004'

Happy suggestion

Suggestions

23004

pages

replace 'pages' by '23004'

Happy suggestion

Suggestions

23004

replace '12' by '23004'

Happy suggestion

Suggestions

23004

2021),

replace '2021),' by '23004'

Happy suggestion

Suggestions

23004

(MADWeb

replace '(MADWeb' by '23004'

Happy suggestion

Suggestions

23004

Web

replace 'Web' by '23004'

Happy suggestion

Suggestions

23004

the

replace 'the' by '23004'

Happy suggestion

Suggestions

23004

for

replace 'for' by '23004'

Happy suggestion

Suggestions

23004

Defenses

replace 'Defenses' by '23004'

Happy suggestion

Suggestions

23004

and

replace 'and' by '23004'

Happy suggestion

Suggestions

23004

Attacks,

replace 'Attacks,' by '23004'

Happy suggestion

Suggestions

23004

Measurements,

replace 'Measurements,' by '23004'

Happy suggestion

Suggestions

23004

Measurements

replace 'Measurements' by '23004'

Happy suggestion

Suggestions

23004

replace 'on' by '23004'

Happy suggestion

Suggestions

23004

Workshop

replace 'Workshop' by '23004'

Happy suggestion

Suggestions

23004

Martin

replace 'Martin' by '23004'

Happy suggestion

Suggestions

23004

Baudry,

replace 'Baudry,' by '23004'

Happy suggestion

Suggestions

23004

Benoit

replace 'Benoit' by '23004'

Happy suggestion

Suggestions

23004

Vera-Pérez,

replace 'Vera-Pérez,' by '2021.'

Happy suggestion

Suggestions

2021.

Oscar

replace 'Oscar' by 'https://doi.org/10.14722/madweb.'

Happy suggestion

Suggestions

https://doi.org/10.14722/madweb.

Floros,

replace 'Floros,' by 'pages'

Happy suggestion

Suggestions

pages

Orestis

replace 'Orestis' by '12'

Suggestions

insert '' by 'Defenses'

Happy suggestion

Suggestions

Defenses

insert '' by 'and'

Happy suggestion

Suggestions

insert '' by 'Attacks,'

Happy suggestion

Suggestions

Attacks,

insert '' by 'Measurements,'

Happy suggestion

Suggestions

Measurements,

insert '' by 'Measurements'

Happy suggestion

Suggestions

Measurements

insert '' by 'on'

Happy suggestion

Suggestions

insert '' by 'Workshop'

Happy suggestion

Suggestions

Workshop

insert '' by 'Monperrus'

Happy suggestion

Suggestions

Monperrus

insert '' by 'Martin'

Happy suggestion

Suggestions

Martin

insert '' by 'Baudry,'

Happy suggestion

Suggestions

Baudry,

insert '' by 'Benoit'

Happy suggestion

Suggestions

Benoit

insert '' by 'Vera-Pérez,'

Happy suggestion

Suggestions

Vera-Pérez,

insert '' by 'Oscar'

Happy suggestion

Suggestions

Oscar

insert '' by 'Floros,'

Happy suggestion

Suggestions

Floros,

insert '' by 'Orestis'

Happy suggestion

Suggestions

Orestis

insert '' by 'Cabrera-Arteaga,'

Happy suggestion

Suggestions

Cabrera-Arteaga,

insert '' by 'Javier'

Happy suggestion

Suggestions

Javier

insert '' by 'bytecode.'

Happy suggestion

Suggestions

bytecode.

insert '' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

randomization

replace 'randomization' by 'for'

Happy suggestion

Suggestions

Code

replace 'Code' by 'randomization'

Happy suggestion

Suggestions

randomization

CROW:

replace 'CROW:' by 'Code'

Happy suggestion

Suggestions

Code

replace 'I:' by 'CROW:'

Happy suggestion

Suggestions

CROW:

Measurements Measurements

Possible typo: you repeated a word

Happy suggestion

Suggestions

Measurements

1.1

replace '1.1' by '1.1,'

Happy suggestion

This compilation thesis comprises the following research papers. In Table 1.1, we map the contributions to our research papers.

This compilation thesis comprises the following research papers. In Table 1.1 we map the contributions to our research papers.

Suggestions

1.1,

papers

replace 'papers' by 'papers.'

Happy suggestion

Summary of research papers.

Summary of research papers

Suggestions

papers.

delete 'Summary:' by ''

Happy suggestion

This paper introduces WASM-MUTATE, a compiler-agnostic WebAssembly diversification engine. The engine is designed to swiftly generate functionally equivalent yet behaviorally diverse WebAssembly variants by randomly traversing e-graphs. E-graphs are specific graph data structures for representing and applying rewriting rules. We show that WASM-MUTATE can generate tens of thousands of unique WebAssembly variants in minutes. Importantly, WASM-MUTATE can safeguard WebAssembly binaries from timing side-channel attacks, such as Spectre.

Summary: This paper introduces WASM-MUTATE, a compiler-agnostic WebAssembly diversification engine. The engine is designed to swiftly generate functionally equivalent yet behaviorally diverse WebAssembly variants by randomly traversing e-graphs. E-graphs are specific graph data structures for representing and applying rewriting rules. We show that WASM-MUTATE can generate tens of thousands of unique WebAssembly variants in minutes. Importantly, WASM-MUTATE can safeguard WebAssembly binaries from timing side-channel attacks, such as Spectre.

Suggestions

00324

replace '00324' by '00324.'

Happy suggestion

Ill: WASM-MUTATE: Fast and efficient Software Diversification for WebAssembly. Javier Cabrera-Arteaga, Nicholas Fitzgerald, Martin Monperrus, Benoit Baudry Computers & Security, 2024, 20 pages https://www.sciencedirect.com/science/article/pii/S01674048240 00324.

Suggestions

00324.

insert '' by 'outline.'

Happy suggestion

Thesis outline outline.

Thesis outline

Suggestions

outline.

summarises

replace 'summarises' by 'summarizes'

Software Diversification. In Section 2.1, we discuss WebAssembly, focusing on its design and security model. Besides, we discuss the current state-of-the-art of WebAssembly research. In Section 2.2 we discuss related works in the area of Software Diversification. Moreover, we delve into the open challenges regarding the diversification of WebAssembly programs. The chapter discusses the state-of-the-art in the areas of WebAssembly and WebAssembly.

Software Diversification. In Section 2.1 we discuss WebAssembly, focusing on its design and security model. Besides, we discuss the current state-of-the-art of WebAssembly research. In Section 2.2 we discuss related works in the area of Software Diversification. Moreover, we delve into the open challenges regarding the diversification of WebAssembly programs. T"s chapter discusses the state-of-the-art in the areas of WebAssembly and

Suggestions

WebAssembly.

insert '' by 'Tolkien.'

Happy suggestion

— J.R.R. Tolkien's Tolkien.

— J.R.R. Tolkien

Suggestions

Tolkien.

Tolkien

replace 'Tolkien' by 'Tolkien's'

Happy suggestion

— J.R.R. Tolkien's Tolkien.

— J.R.R. Tolkien

Suggestions

Tolkien's

Otherwise

replace 'Otherwise' by 'Otherwise,'

Happy suggestion

You must have a map, no matter how rough. Otherwise, you wander all over the place.

You must have a map, no matter how rough. Otherwise you wander all over the place.

Suggestions

Otherwise,

Otherwise

A comma may be missing after the conjunctive/linking adverb ‘Otherwise’.

Happy suggestion

You must have a map, no matter how rough. Otherwise you wander all over the place.

Suggestions

Otherwise,

ART

replace 'ART' by 'ART.'

Happy suggestion

BACKGROUND AND STATE OF THE ART.

BACKGROUND AND STATE OF THE ART

Suggestions

ART.

lThe

replace 'lThe' by 'The'

Happy suggestion

The WAT text format is primarily designed for human readability and for low-level manual editing.

lThe WAT text format is primarily designed for human readability and for low-level manual editing.

Suggestions

the

delete 'the' by ''

Happy suggestion

There are several compilers that turn source code into WebAssembly binaries. For example, LLVM compiles to WebAssembly as a backend option since its 7.1.0 release in early 20197, supporting a diverse set of frontend languages like C/C++, Rust, Go, and AssemblyScript®. Significantly, a study by Hilbig [45] reveals that 70% of WebAssembly binaries are generated using LLVM-based compilers. The main advantage of using LLVM is that it provides a modular and state-of-the-art optimization infrastructure for WebAssembly binaries. Today, Emscripten* is the most frequently used tool for porting C/C++ code to the Web as a drop-in replacement for a standard compiler like gcc or clang. The main advantage of Emscripten is that it provides a complete toolchain for compiling C/C++ code to WebAssembly, including the automatic generation of external functions for interacting with a Web host environment. Recently, the Kotlin Multiplatform framework® has incorporated WebAssembly as a compilation target, enabling the compilation of Kotlin code to WebAssembly. Similarly, the Cheerp® project proposes a Java Virtual Machine(JVM) fully ported to WebAssembly, supporting Java applications and legacy applets in the browser.

There are several compilers that turn source code into WebAssembly binaries. For example, LLVM compiles to WebAssembly as a backend option since its 7.1.0 release in early 20197, supporting a diverse set of frontend languages like C/C++, Rust, Go, and AssemblyScript®. Significantly, a study by Hilbig [45] reveals that 70% of WebAssembly binaries are generated using LLVM-based compilers. The main advantage of using LLVM is that it provides a modular and state-of-the-art optimization infrastructure for WebAssembly binaries. Today, Emscripten* is the most frequently used tool for porting C/C++ code to the Web as a drop-in replacement for a standard compiler like gcc or clang. The main advantage of Emscripten is that it provides a complete toolchain for compiling C/C++ code to WebAssembly, including the automatic generation of the external functions for interacting with a Web host environment. Recently, the Kotlin Multiplatform framework® has incorporated WebAssembly as a compilation target, enabling the compilation of Kotlin code to WebAssembly. Similarly, the Cheerp® project proposes a Java Virtual Machine(JVM) fully ported to WebAssembly, supporting Java applications and legacy applets in the browser.

Suggestions

20197

Did you mean to type a 4-digit year?

Happy suggestion

There are several compilers that turn source code into WebAssembly binaries. For example, LLVM compiles to WebAssembly as a backend option since its 7.1.0 release in early 20197, supporting a diverse set of frontend languages like C/C++, Rust, Go, and AssemblyScript®. Significantly, a study by Hilbig [45] reveals that 70% of WebAssembly binaries are generated using LLVM-based compilers. The main advantage of using LLVM is that it provides a modular and state-of-the-art optimization infrastructure for WebAssembly binaries. Today, Emscripten* is the most frequently used tool for porting C/C++ code to the Web as a drop-in replacement for a standard compiler like gcc or clang. The main advantage of Emscripten is that it provides a complete toolchain for compiling C/C++ code to WebAssembly, including the automatic generation of the external functions for interacting with a Web host environment. Recently, the Kotlin Multiplatform framework® has incorporated WebAssembly as a compilation target, enabling the compilation of Kotlin code to WebAssembly. Similarly, the Cheerp® project proposes a Java Virtual Machine(JVM) fully ported to WebAssembly, supporting Java applications and legacy applets in the browser.

Suggestions

insert '' by 'Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.'

Happy suggestion

*https://github.com/11vm/1lvm-project/releases/tag/llvmorg-7.1.0 3A subset of the TypeScript language “nttps://emscripten.org/docs/tools_reference/emcc. html Shttps://kotlinlang.org/docs/wasm-overview. html Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.html Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.html Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.html Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.

Suggestions

Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.

Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive

replace 'Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive' by 'Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.html'

Happy suggestion

Suggestions

Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.html

html

replace 'html' by 'Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.html'

Happy suggestion

Suggestions

Shttps://labs.leaningtech.com/blog/cheerpj-3-deep-dive.html

html

“

Unpaired symbol: ‘”’ seems to be missing

Happy suggestion

Suggestions

insert '' by ';'

Happy suggestion

Block ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ; label @2 ;

block ; label @2

Suggestions

;

insert '' by '@2'

Suggestions

Block

block

This sentence does not start with an uppercase letter.

Happy suggestion

block ; label @2

Suggestions

Block

insert '' by 'loc'

Happy suggestion

Local.get 0 return ; Return the last element which is saved in locpl O end 3 ; Return the last element which is saved in locpl O end 3 ; Return the last element which is saved in locpl O end 3 ; Return the last element which is saved in locpl O end 3 ; Return the last element which is saved in locpl O end 3 ; Return the last element which is saved in locpl O end 3 ; Return the last element which is saved in loc

local.get 0 return ; Return the last element which is saved in locpl O end 3

Suggestions

insert '' by 'in'

Happy suggestion

local.get 0 return ; Return the last element which is saved in locpl O end 3

Suggestions

insert '' by 'saved'

Happy suggestion

local.get 0 return ; Return the last element which is saved in locpl O end 3

Suggestions

saved

insert '' by 'is'

Happy suggestion

local.get 0 return ; Return the last element which is saved in locpl O end 3

insert '' by 'Return'

Happy suggestion

local.get 0 return ; Return the last element which is saved in locpl O end 3

Suggestions

Return

insert '' by ';'

Happy suggestion

local.get 0 return ; Return the last element which is saved in locpl O end 3

Suggestions

;

locpl

local.get

replace 'local.get' by 'Local.get'

Happy suggestion

local.get 0 return ; Return the last element which is saved in locpl O end 3

Suggestions

Local.get

local

This sentence does not start with an uppercase letter.

Happy suggestion

local.get 0 return ; Return the last element which is saved in locpl O end 3

Suggestions

Local

132.store

delete '132.store' by ''

Happy suggestion

OANAAKRWNHHE (module (type (import "__wbg__" " (@custom "name" "... Celine ) (func (param i32 i32))) __wbg_log" (func () (type 0))) __wbg_getinput" (func () (type 8))) ")) (type 1) (param i32) (result i32) Clecal i132 i182 132 132 i32) loop 132.eqz tf local.get

OANAAKRWNHHE (module (type ¢ (import "__wbg__" " (import "__wbg__" " (@custom "name" "... Celine ¢) (func (param i32 i32))) __wbg_log" (func () (type 0))) __wbg_getinput" (func () (type 8))) ")) (type 1) (param i32) (result i32) Clecal i132 i182 132 132 i32) loop 132.eqz tf local.get 0 return end 132.store

Suggestions

end

delete 'end' by ''

Happy suggestion

Suggestions

"__wbg__"

replace '"__wbg__"' by '"...'

Happy suggestion

Suggestions

"...

(import

replace '(import' by '"name"'

Happy suggestion

Suggestions

"name"

replace '"' by '(@custom'

Happy suggestion

Suggestions

(@custom

(import

example.

delete 'example.' by ''

Happy suggestion

132.store Fy br i ) end end) (func () (type 8) (result i32) call 2 1i32.store (func () (type 7) (local i32 i32 i32) call 44 call 40 i32.store offset=20 (table () 33 33 funcref) (memory () 17) (global () (mut i32) (€i32.const 1048576)) ( This example showcases the translation from Rust to Wasm. For clarity, we have marked elements and portions of the WebAssembly binary as comments.

132.store Fy br i ¢) end end) (func () (type 8) (result i32) call 2 1i32.store (func () (type 7) (local i32 i32 i32) call 44 call 40 i32.store offset=20 (table () 33 33 funcref) (memory () 17) (global () (mut i32) (€i32.const 1048576)) (export "memory" (memory 0)) (export "fibo" (func 40)) (export "main" (func 45)) (data () (132.const 1048576) "invalid args...") (@custom "producers" "...") Listing 2.2: Refer to Listing 2.1 for the Rust code example. This example showcases the translation from Rust to Wasm. For clarity, we have marked elements and portions of the WebAssembly binary as comments.

Suggestions

(mut

insert '' by '(global'

Happy suggestion

Suggestions

(global

funcref)

()

i32.store

replace 'i32.store' by '(table'

Happy suggestion

Suggestions

(table

replace '40' by 'offset=20'

Happy suggestion

Suggestions

offset=20

call

replace 'call' by 'i32.store'

Happy suggestion

Suggestions

i32.store

replace '44' by '40'

Happy suggestion

Suggestions

insert '' by '44'

Happy suggestion

Suggestions

i32)

replace 'i32)' by 'call'

Happy suggestion

Suggestions

call

)

2.1

replace '2.1' by '2.1,'

Happy suggestion

The Wasm binary format is close to machine code and already optimized, being a consecutive collection of sections. In Figure 2.1, we show the binary format of a Wasm section. A Wasm section starts with a 1-byte section ID, followed by a 4-byte section size, and concludes with the section content, which precisely matches the size indicated earlier. A WebAssembly binary contains sections of 13 types, each with a specific semantic role and placement within the module. For instance, the Custom Section stores metadata like the compiler used to generate the binary, while the Type Section contains function signatures that serve to validate the Function Section. The Import Section lists elements imported from the host, and the Function Section details the functions defined within the binary. Other sections like Table, Memory, and Global Sections specify the structure for indirect calls, unmanaged linear memories, and global variables, respectively. Export, Start, Element, Code, Data, and Data Count Sections handle aspects ranging from declaring elements for host engine access to initializing program state, declaring bytecode instructions per function, and initializing linear memory. Each of these sections must occur only once in a binary and can be empty. For clarity, we also annotate sections as comments in the Wasm code in Listing 2.2.

The Wasm binary format is close to machine code and already optimized, being a consecutive collection of sections. In Figure 2.1 we show the binary format of a Wasm section. A Wasm section starts with a 1-byte section ID, followed by a 4-byte section size, and concludes with the section content, which precisely matches the size indicated earlier. A WebAssembly binary contains sections of 13 types, each with a specific semantic role and placement within the module. For instance, the Custom Section stores metadata like the compiler used to generate the binary, while the Type Section contains function signatures that serve to validate the Function Section. The Import Section lists elements imported from the host, and the Function Section details the functions defined within the binary. Other sections like Table, Memory, and Global Sections specify the structure for indirect calls, unmanaged linear memories, and global variables, respectively. Export, Start, Element, Code, Data, and Data Count Sections handle aspects ranging from declaring elements for host engine access to initializing program state, declaring bytecode instructions per function, and initializing linear memory. Each of these sections must occur only once in a binary and can be empty. For clarity, we also annotate sections as comments in the Wasm code in Listing 2.2.

Suggestions

2.1,

format

replace 'format' by 'format.'

Happy suggestion

WebAssembly’s binary format is the same as the WebAssembly’s binary format.

WebAssembly’s binary format

Suggestions

format.

same

insert '' by 'is'

Happy suggestion

WebAssembly’s binary format is the same as the WebAssembly’s binary format.

WebAssembly’s binary format

WebAssembly’s

Javy”

replace 'Javy”' by '“Javy”'

Happy suggestion

A recent trend in the WebAssembly ecosystem involves porting various programming languages by converting both the language’s engine or interpreter and the source code into a WebAssembly program. For example, “Javy” encapsulates JavaScript code within the QuickJS interpreter, demonstrating that direct source code conversion to WebAssembly isn’t always required. If an interpreter for a specific language can be compiled to WebAssembly, it allows for the bundling of both the interpreter and the language into a single, isolated WebAssembly binary. Similarly, Blazor® facilitates the execution of INET Common Intermediate Language (CIL) in WebAssembly binaries for browser-based applications. However, packaging the interpreter and the code in one single standalone WebAssembly binary is still immature and faces challenges. For example, the absence of JIT compilation for the “interpreted” code makes it less suitable for long-running tasks [46, 47]. On the other hand, it proves effective for short-running tasks, particularly those executed in Edge-Cloud computing platforms.

A recent trend in the WebAssembly ecosystem involves porting various programming languages by converting both the language’s engine or interpreter and the source code into a WebAssembly program. For example, Javy” encapsulates JavaScript code within the QuickJS interpreter, demonstrating that direct source code conversion to WebAssembly isn’t always required. If an interpreter for a specific language can be compiled to WebAssembly, it allows for the bundling of both the interpreter and the language into a single, isolated WebAssembly binary. Similarly, Blazor® facilitates the execution of INET Common Intermediate Language (CIL) in WebAssembly binaries for browser-based applications. However, packaging the interpreter and the code in one single standalone WebAssembly binary is still immature and faces challenges. For example, the absence of JIT compilation for the “interpreted” code makes it less suitable for long-running tasks [46, 47]. On the other hand, it proves effective for short-running tasks, particularly those executed in Edge-Cloud computing platforms.

Suggestions

“Javy”

”

Unpaired symbol: ‘“’ seems to be missing

Happy suggestion

A recent trend in the WebAssembly ecosystem involves porting various programming languages by converting both the language’s engine or interpreter and the source code into a WebAssembly program. For example, Javy” encapsulates JavaScript code within the QuickJS interpreter, demonstrating that direct source code conversion to WebAssembly isn’t always required. If an interpreter for a specific language can be compiled to WebAssembly, it allows for the bundling of both the interpreter and the language into a single, isolated WebAssembly binary. Similarly, Blazor® facilitates the execution of INET Common Intermediate Language (CIL) in WebAssembly binaries for browser-based applications. However, packaging the interpreter and the code in one single standalone WebAssembly binary is still immature and faces challenges. For example, the absence of JIT compilation for the “interpreted” code makes it less suitable for long-running tasks [46, 47]. On the other hand, it proves effective for short-running tasks, particularly those executed in Edge-Cloud computing platforms.

Suggestions

insert '' by 'Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web'

Happy suggestion

“https://github.com/bytecodealliance/javy Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor.html Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor.html Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web

“https://github.com/bytecodealliance/javy Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor

Suggestions

Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web

insert '' by 'Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor.html'

Happy suggestion

“https://github.com/bytecodealliance/javy Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor

Suggestions

Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor.html

Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor

replace 'Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor' by 'Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor.html'

Happy suggestion

“https://github.com/bytecodealliance/javy Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor

Suggestions

Shttps://dotnet.microsoft.com/en-us/apps/aspnet/web-apps/blazor.html

Stack:

delete 'Stack:' by ''

Happy suggestion

At runtime, WebAssembly engines instantiate a WebAssembly module. This module is a runtime representation of a loaded and initialized WebAssembly binary described in Section 2.1.2. The primary component of a module instance is its Execution Stack. The Execution Stack stores typed values, labels, and control frames. Labels manage block instruction starts and loop starts. Control frames manage function calls and function returns. Values within the stack can only be static types. These types include i32 for 32-bit signed integers, i64 for 64-bit signed integers, £32 for 32-bit floats, and £64 for 64-bit floats. Abstract types such as classes, objects, and arrays are not supported natively. Instead, these types are abstracted into primitive types during compilation and stored in linear memory.

Execution Stack: At runtime, WebAssembly engines instantiate a WebAssembly module. This module is a runtime representation of a loaded and initialized WebAssembly binary described in Section 2.1.2. The primary component of a module instance is its Execution Stack. The Execution Stack stores typed values, labels, and control frames. Labels manage block instruction starts and loop starts. Control frames manage function calls and function returns. Values within the stack can only be static types. These types include i32 for 32-bit signed integers, i64 for 64-bit signed integers, £32 for 32-bit floats, and £64 for 64-bit floats. Abstract types such as classes, objects, and arrays are not supported natively. Instead, these types are abstracted into primitive types during compilation and stored in linear memory.

Suggestions

Execution

delete 'Execution' by ''

Happy suggestion

Suggestions

runtime

replace 'runtime' by 'runtime.'

Happy suggestion

WebAssembly’s runtime runs at the same time as WebAssembly’s runtime.

WebAssembly’s runtime

Suggestions

runtime.

insert '' by 'as'

Happy suggestion

WebAssembly’s runtime runs at the same time as WebAssembly’s runtime.

WebAssembly’s runtime

runs

insert '' by 'runtime'

Happy suggestion

WebAssembly’s runtime runs at the same time as WebAssembly’s runtime.

WebAssembly’s runtime

Suggestions

runtime

insert '' by 'WebAssembly’s'

Happy suggestion

WebAssembly’s runtime runs at the same time as WebAssembly’s runtime.

WebAssembly’s runtime

Suggestions

WebAssembly’s

This sentence does not start with an uppercase letter.

Happy suggestion

i+ i+9 i+9+ Size ID1 Size Content ID2

Suggestions

org

This sentence does not start with an uppercase letter.

Happy suggestion

°nttps://en.wikipedia. org/wiki/LEB128

Suggestions

Functions:

delete 'Functions:' by ''

Happy suggestion

At runtime, WebAssembly functions are closures over the module instance, grouping locals and function bodies. Locals are typed variables that are local to a specific function invocation. A function body is a sequence of instructions that are executed when the function is called. Each instruction either reads from the execution stack, writes to the execution stack, reads from the linear memory, writes to the linear memory, reads a global, writes a global or modifies the control-flow of the function. Recalling the example WebAssembly binary, the local variable declarations and typed instructions that are evaluated using the stack can be appreciated between Line 15 and Line 19 in Listing 2.2. When an instruction reads its operands from the stack, it pushes back the result. Notice that, numeric instructions are annotated with their corresponding type.

Functions: At runtime, WebAssembly functions are closures over the module instance, grouping locals and function bodies. Locals are typed variables that are local to a specific function invocation. A function body is a sequence of instructions that are executed when the function is called. Each instruction either reads from the execution stack, writes to the execution stack, reads from the linear memory, writes to the linear memory, reads a global, writes a global or modifies the control-flow of the function. Recalling the example WebAssembly binary, the local variable declarations and typed instructions that are evaluated using the stack can be appreciated between Line 15 and Line 19 in Listing 2.2. When an instruction reads its operands from the stack, it pushes back the result. Notice that, numeric instructions are annotated with their corresponding type.

Suggestions

when

delete 'when' by ''

Happy suggestion

A WebAssembly module instance incorporates three key types of memory-related components: linear memory, local variables and global variables. These components can either be managed solely by the host engine or shared with the WebAssembly binary itself. This division of responsibility is often categorized as managed and unmanaged memory [20]. Managed refers to components that are exclusively modified by the host engine at the lowest level, e.g. When the WebAssembly binary is JITed, while unmanaged components can also be altered through WebAssembly opcodes. First, modules may include a linear memory instance, which is a contiguous array of bytes. This linear memory is accessed using 32-bit integers (132) and is shareable only between the initiating engine and the WebAssembly module instance. Generally, the linear memory is considered to be unmanaged, e.g., line 28 of Listing 2.2 shows an explicit memory access opcode. Second, there are global instances, which are variables accompanied by values and mutability flags (see example in line 49 of Listing 2.2). These globals are managed by the host engine, which controls their allocation and memory placement completely oblivious to the WebAssembly binary scope. They can only be accessed via their declaration index, prohibiting dynamic addressing. Third, local variables are mutable and specific to a given function instance (e.g., line 15 and line 22 in Listing 2.2). They are accessible only through their index relative to the executing function and are part of the data managed by the host engine.

Memory model: A WebAssembly module instance incorporates three key types of memory-related components: linear memory, local variables and global variables. These components can either be managed solely by the host engine or shared with the WebAssembly binary itself. This division of responsibility is often categorized as managed and unmanaged memory [20]. Managed refers to components that are exclusively modified by the host engine at the lowest level, e.g. when the WebAssembly binary is JITed, while unmanaged components can also be altered through WebAssembly opcodes. First, modules may include a linear memory instance, which is a contiguous array of bytes. This linear memory is accessed using 32-bit integers (132) and is shareable only between the initiating engine and the WebAssembly module instance. Generally, the linear memory is considered to be unmanaged, e.g., line 28 of Listing 2.2 shows an explicit memory access opcode. Second, there are global instances, which are variables accompanied by values and mutability flags (see example in line 49 of Listing 2.2). These globals are managed by the host engine, which controls their allocation and memory placement completely oblivious to the WebAssembly binary scope. They can only be accessed via their declaration index, prohibiting dynamic addressing. Third, local variables are mutable and specific to a given function instance (e.g., line 15 and line 22 in Listing 2.2). They are accessible only through their index relative to the executing function and are part of the data managed by the host engine.

Suggestions

e.g.

delete 'e.g.' by ''

Suggestions

level,

replace 'at' by 'lowest'

Happy suggestion

Suggestions

lowest

host

modified

that

replace 'that' by 'exclusively'

Happy suggestion

Suggestions

exclusively

components

replace 'components' by 'are'

Happy suggestion

Suggestions

replace 'to' by 'that'

Happy suggestion

Suggestions

that

refers

replace 'refers' by 'components'

Happy suggestion

Suggestions

components

Managed

replace 'Managed' by 'to'

Suggestions

unmanaged

replace 'as' by 'and'

Happy suggestion

Suggestions

categorized

replace 'categorized' by 'managed'

Happy suggestion

Suggestions

managed

often

replace 'often' by 'as'

Happy suggestion

Suggestions

replace 'is' by 'categorized'

Happy suggestion

Suggestions

categorized

responsibility

This

replace 'This' by 'of'

Suggestions

replace 'or' by 'with'

Happy suggestion

Suggestions

with

engine

replace 'engine' by 'shared'

Happy suggestion

Suggestions

shared

replace 'be' by 'solely'

Happy suggestion

Suggestions

solely

either

replace 'either' by 'managed'

Happy suggestion

Suggestions

managed

can

replace 'can' by 'be'

Happy suggestion

Suggestions

components

replace 'components' by 'either'

Happy suggestion

Suggestions

either

These

replace 'These' by 'can'

linear

replace 'of' by 'components:'

Happy suggestion

Suggestions

components:

types

replace 'types' by 'memory-related'

Happy suggestion

Suggestions

memory-related

key

replace 'key' by 'of'

Happy suggestion

Suggestions

three

replace 'three' by 'types'

Happy suggestion

Suggestions

types

incorporates

replace 'incorporates' by 'key'

Happy suggestion

Suggestions

instance

replace 'instance' by 'three'

Happy suggestion

Suggestions

three

module

replace 'module' by 'incorporates'

Happy suggestion

Suggestions

incorporates

replace 'A' by 'module'

Happy suggestion

Suggestions

module

model:

replace 'model:' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

Memory

replace 'Memory' by 'A'

Happy suggestion

Suggestions

execution:

delete 'execution:' by ''

Happy suggestion

While a WebAssembly binary could be interpreted, the most practical approach is to JIT compile it into machine code [48]. The main reason is that WebAssembly is optimized and closely aligned with machine code, leading to swift JIT compilation for execution. Browser engines such as V8!° and SpiderMonkey! use this strategy when executing WebAssembly binaries in browser clients. In practice, browsers initially employ a baseline compiler to ensure the rapid availability of incoming WebAssembly binaries. Simultaneously, an optimizing compiler operates in the background. Consequently, the first generated machine code is eventually supplanted by the optimized version. Once JITed, the WebAssembly binary operates within a sandboxed environment, accessing the host environment exclusively through imported functions. This sandboxing follows the Software Fault Isolation (SFI) guarantee, meaning that a WebAssembly program cannot arbitrarily access code or data of its runtime.

WebAssembly module execution: While a WebAssembly binary could be interpreted, the most practical approach is to JIT compile it into machine code [48]. The main reason is that WebAssembly is optimized and closely aligned with machine code, leading to swift JIT compilation for execution. Browser engines such as V8!° and SpiderMonkey! use this strategy when executing WebAssembly binaries in browser clients. In practice, browsers initially employ a baseline compiler to ensure the rapid availability of incoming WebAssembly binaries. Simultaneously, an optimizing compiler operates in the background. Consequently, the first generated machine code is eventually supplanted by the optimized version. Once JITed, the WebAssembly binary operates within a sandboxed environment, accessing the host environment exclusively through imported functions. This sandboxing follows the Software Fault Isolation (SFI) guarantee, meaning that a WebAssembly program cannot arbitrarily access code or data of its runtime.

Suggestions

module

delete 'module' by ''

Happy suggestion

Suggestions

15https://github.com/WAVM/WAVM

replace '15https://github.com/WAVM/WAVM' by '//github.com'

Happy suggestion

While initially intended for browsers, WebAssembly has undergone significant evolution, primarily due to WASI [41]. WASI establishes a standardized POSIX-like interface for interactions between WebAssembly modules and host environments. Compilers can generate WebAssembly binaries that implement WASI, which allows execution in standalone engines. These binaries can then be executed by standalone engines across a variety of environments, including the cloud, servers, and IoT devices [49, 48]. Similarly to browsers, these engines often translate WebAssembly into machine code via JIT compilation, ensuring a sandboxed execution process. Standalone engines such as WASM3!?, Wasmer!*, Wasmtime!4, WAVM" and Sledge [50] have been developed to support both WebAssembly and WASI. 10ntps: //chromium. Googlesource.com/v8/v8.git llhttps://spidermonkey.dev/ 12ntps: //github.com/wasm3/wasm3 13https://wasmer.io/ M4ntps: //github.com/bytecodealliance/wasmtime 15https://github.com/WAVM/WAVM.git llhttps://spidermonkey.dev/ 12ntps: //github.com

WebAssembly standalone engines: While initially intended for browsers, WebAssembly has undergone significant evolution, primarily due to WASI [41]. WASI establishes a standardized POSIX-like interface for interactions between WebAssembly modules and host environments. Compilers can generate WebAssembly binaries that implement WASI, which allows execution in standalone engines. These binaries can then be executed by standalone engines across a variety of environments, including the cloud, servers, and IoT devices [49, 48]. Similarly to browsers, these engines often translate WebAssembly into machine code via JIT compilation, ensuring a sandboxed execution process. Standalone engines such as WASM3!?, Wasmer!*, Wasmtime!4, WAVM", and Sledge [50] have been developed to support both WebAssembly and WASI. 10nttps: //chromium. googlesource.com/v8/v8.git llhttps://spidermonkey.dev/ 12nttps: //github.com/wasm3/wasm3 13https://wasmer.io/ M4nttps: //github.com/bytecodealliance/wasmtime 15https://github.com/WAVM/WAVM

Suggestions

//github.com

//github.com/bytecodealliance/wasmtime

replace '//github.com/bytecodealliance/wasmtime' by '12ntps:'

Happy suggestion

Suggestions

12ntps:

M4nttps:

replace 'M4nttps:' by 'llhttps://spidermonkey.dev/'

Happy suggestion

Suggestions

llhttps://spidermonkey.dev/

13https://wasmer.io/

replace '13https://wasmer.io/' by '15https://github.com/WAVM/WAVM.git'

Happy suggestion

Suggestions

15https://github.com/WAVM/WAVM.git

//github.com/wasm3/wasm3

replace '//github.com/wasm3/wasm3' by '//github.com/bytecodealliance/wasmtime'

Happy suggestion

Suggestions

//github.com/bytecodealliance/wasmtime

12nttps:

replace '12nttps:' by 'M4ntps:'

Happy suggestion

Suggestions

M4ntps:

llhttps://spidermonkey.dev/

replace 'llhttps://spidermonkey.dev/' by '13https://wasmer.io/'

Happy suggestion

Suggestions

13https://wasmer.io/

googlesource.com/v8/v8.git

replace 'googlesource.com/v8/v8.git' by '//github.com/wasm3/wasm3'

Happy suggestion

Suggestions

//github.com/wasm3/wasm3

//chromium.

replace '//chromium.' by '12ntps:'

Happy suggestion

Suggestions

12ntps:

10nttps:

replace '10nttps:' by 'llhttps://spidermonkey.dev/'

Happy suggestion

Suggestions

llhttps://spidermonkey.dev/

WASI.

replace 'WASI.' by 'Googlesource.com/v8/v8.git'

Happy suggestion

Suggestions

Googlesource.com/v8/v8.git

and

replace 'and' by '//chromium.'

Happy suggestion

Suggestions

//chromium.

both

replace 'both' by 'WASI.'

Happy suggestion

Suggestions

WASI.

support

replace 'support' by 'and'

Happy suggestion

Suggestions

replace 'to' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

developed

replace 'developed' by 'both'

Happy suggestion

Suggestions

both

been

replace 'been' by 'support'

Happy suggestion

Suggestions

support

have

replace 'have' by 'to'

Suggestions

WASM3!?,

replace 'WASM3!?,' by 'WAVM"'

Happy suggestion

Suggestions

WAVM"

replace 'as' by 'Wasmtime!4,'

Happy suggestion

Suggestions

Wasmtime!4,

such

replace 'such' by 'Wasmer!*,'

Happy suggestion

Suggestions

Wasmer!*,

engines

replace 'engines' by 'WASM3!?,'

Happy suggestion

Suggestions

WASM3!?,

Standalone

replace 'Standalone' by 'as'

Suggestions

Standalone

replace 'a' by 'process.'

Happy suggestion

Suggestions

process.

ensuring

replace 'ensuring' by 'execution'

Happy suggestion

Suggestions

execution

compilation,

replace 'compilation,' by 'sandboxed'

Happy suggestion

Suggestions

sandboxed

JIT

replace 'JIT' by 'a'

Suggestions

into

replace 'into' by 'via'

Suggestions

often

replace 'to' by 'engines'

Happy suggestion

Suggestions

engines

Similarly

replace 'Similarly' by 'these'

Happy suggestion

Suggestions

these

48].

replace '48].' by 'browsers,'

Happy suggestion

Suggestions

browsers,

[49,

replace '[49,' by 'to'

Suggestions

the

replace 'the' by 'and'

Happy suggestion

Suggestions

including

replace 'including' by 'servers,'

Happy suggestion

Suggestions

servers,

environments,

across

replace 'across' by 'of'

Happy suggestion

Suggestions

engines

replace 'engines' by 'variety'

Happy suggestion

Suggestions

variety

standalone

replace 'standalone' by 'a'

Happy suggestion

Suggestions

replace 'by' by 'across'

Happy suggestion

Suggestions

across

executed

replace 'executed' by 'engines'

Happy suggestion

Suggestions

engines

replace 'be' by 'standalone'

Happy suggestion

Suggestions

standalone

then

replace 'then' by 'by'

Happy suggestion

Suggestions

can

replace 'can' by 'executed'

Happy suggestion

Suggestions

executed

binaries

replace 'binaries' by 'be'

Happy suggestion

Suggestions

These

replace 'These' by 'then'

Happy suggestion

Suggestions

then

These

execution

replace 'execution' by 'engines.'

Happy suggestion

Suggestions

engines.

allows

replace 'allows' by 'standalone'

Happy suggestion

Suggestions

standalone

which

replace 'which' by 'in'

Suggestions

replace 'a' by 'interface'

Happy suggestion

Suggestions

interface

establishes

replace 'establishes' by 'POSIX-like'

Happy suggestion

Suggestions

POSIX-like

[41].

replace '[41].' by 'a'

Happy suggestion

Suggestions

replace 'to' by 'WASI'

Happy suggestion

Suggestions

WASI

due

replace 'due' by '[41].'

Happy suggestion

Suggestions

[41].

primarily

replace 'primarily' by 'WASI'

Happy suggestion

Suggestions

WASI

primarily

has

replace 'has' by 'evolution,'

Happy suggestion

Suggestions

evolution,

browsers,

replace 'browsers,' by 'undergone'

Happy suggestion

Suggestions

undergone

for

replace 'for' by 'has'

Suggestions

engines:

replace 'engines:' by 'intended'

Happy suggestion

Suggestions

intended

standalone

replace 'standalone' by 'initially'

Happy suggestion

Suggestions

initially

Unpaired symbol: ‘"’ seems to be missing

Happy suggestion

Suggestions

end

delete 'end' by ''

Happy suggestion

Block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to the next instruction; end instructions break ena Jump ;) the block and jump to the next instruction.

block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to next instruction; end

Suggestions

instruction;

replace 'instruction;' by 'instruction.'

Happy suggestion

block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to next instruction; end

Suggestions

instruction.

insert '' by 'the'

Happy suggestion

block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to next instruction; end

Suggestions

insert '' by 'instruction;'

Happy suggestion

block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to next instruction; end

Suggestions

instruction;

jump

insert '' by 'and'

Happy suggestion

block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to next instruction; end

Suggestions

instructions

insert '' by ';'

Happy suggestion

block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to next instruction; end

Suggestions

;

DLoCk

wees

replace 'wees' by 'oe'

Happy suggestion

block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to next instruction; end

with

instructions

Block

block

This sentence does not start with an uppercase letter.

Happy suggestion

block block Toop br 1 ; Jump instructions a are annotated with the br 0 paint oniee eeay wees oe DLoCk they end ; end instructions break ena Jump ;) the block and jump to next instruction; end

Suggestions

Block

delete 'to' by ''

Happy suggestion

A WebAssembly function groups instructions into blocks, with the function’s entrypoint acting as the root block. In contrast to conventional assembly code, control-flow structures in Wasm leap between block boundaries rather than arbitrary positions within the code, effectively prohibiting random code positions. Each block may specify the needed execution stack state before execution as well as the resultant execution stack state once its instructions have been executed. Typically, the execution stack state is the quantity and numeric type of values on the stack. This stack state is used to validate the binary during compilation and to ensure that the stack is in a valid state before the execution of the block’s instructions. Blocks in Wasm are explicit (see instructions block and end in lines 16 and 34 of Listing 2.2), delineating where they start and end. By design, a block cannot reference or execute code from external blocks.

A WebAssembly function groups instructions into blocks, with the function’s entrypoint acting as the root block. In contrast to conventional assembly code, control-flow structures in Wasm leap between block boundaries rather than arbitrary positions within the code, effectively prohibiting gotos to random code positions. Each block may specify the needed execution stack state before execution as well as the resultant execution stack state once its instructions have been executed. Typically, the execution stack state is the quantity and numeric type of values on the stack. This stack state is used to validate the binary during compilation and to ensure that the stack is in a valid state before the execution of the block’s instructions. Blocks in Wasm are explicit (see instructions block and end in lines 16 and 34 of Listing 2.2), delineating where they start and end. By design, a block cannot reference or execute code from external blocks.

Suggestions

gotos

delete 'gotos' by ''

Happy suggestion

A WebAssembly function groups instructions into blocks, with the function’s entrypoint acting as the root block. In contrast to conventional assembly code, control-flow structures in Wasm leap between block boundaries rather than arbitrary positions within the code, effectively prohibiting gotos to random code positions. Each block may specify the needed execution stack state before execution as well as the resultant execution stack state once its instructions have been executed. Typically, the execution stack state is the quantity and numeric type of values on the stack. This stack state is used to validate the binary during compilation and to ensure that the stack is in a valid state before the execution of the block’s instructions. Blocks in Wasm are explicit (see instructions block and end in lines 16 and 34 of Listing 2.2), delineating where they start and end. By design, a block cannot reference or execute code from external blocks.

Suggestions

insert '' by 'This'

Happy suggestion

The WebAssembly ecosystem’s expansion needs robust tools to ensure its security and reliability. Numerous tools, employing various strategies to detect vulnerabilities in WebAssembly programs, have been created to meet this need. This section reviews the most relevant works in this field. We group them by the technique they employ.

The WebAssembly ecosystem’s expansion needs robust tools to ensure its security and reliability. Numerous tools, employing various strategies to detect vulnerabilities in WebAssembly programs, have been created to meet this need.This section reviews the most relevant works in this field. We group them by the technique they employ.

Suggestions

This

need.This

replace 'need.This' by 'need.'

Happy suggestion

The WebAssembly ecosystem’s expansion needs robust tools to ensure its security and reliability. Numerous tools, employing various strategies to detect vulnerabilities in WebAssembly programs, have been created to meet this need.This section reviews the most relevant works in this field. We group them by the technique they employ.

Suggestions

need.

analysis:

delete 'analysis:' by ''

Happy suggestion

SecWasm [52] uses information control-flow checking to identify secrecy leaking in WebAssembly binaries. Similarly, Wasmati [53] employs code property graphs for this purpose. Wasp [54] leverages concolic execution to identify potential vulnerabilities in WebAssembly binaries. CT-Wasm [55], verifies the constant time implementation of cryptographic algorithms in WebAssembly. Similarly, Vivienne applies relational symbolic execution to WebAssembly binaries in order to reveal vulnerabilities in cryptographic implementations [56]. While these tools emphasize specific strategies, others adopt a more holistic approach. For example, both Wassail [57] and WasmA [58] provide a comprehensive static analysis framework for WebAssembly binaries.

Static analysis: SecWasm [52] uses information control-flow checking to identify secrecy leaking in WebAssembly binaries. Similarly, Wasmati [53] employs code property graphs for this purpose. Wasp [54] leverages concolic execution to identify potential vulnerabilities in WebAssembly binaries. CT-Wasm [55], verifies the constant time implementation of cryptographic algorithms in WebAssembly. Similarly, Vivienne applies relational symbolic execution to WebAssembly binaries in order to reveal vulnerabilities in cryptographic implementations [56]. While these tools emphasize specific strategies, others adopt a more holistic approach. For example, both Wassail [57] and WasmA [58] provide a comprehensive static analysis framework for WebAssembly binaries.

Suggestions

Static

delete 'Static' by ''

Happy suggestion

Suggestions

malware:

delete 'malware:' by ''

Happy suggestion

Since the introduction of WebAssembly, the Web has consistently experienced an increase in cryptomalware. This rise primarily stems from the shift of mining algorithms from CPUs to WebAssembly, a transition driven by notable performance benefits [66]. Tools such as MineSweeper [26], MinerRay [27], and MINOS [28] employ static analysis with machine learning techniques to detect browser-based cryptomalware. In addition, SEISMIC [29], RAPID [30], and OUTGuard [31] leverage dynamic analysis techniques to achieve a similar objective. Moreover, VirusTotal’®, a tool incorporating over 60 commercial antivirus systems as black-boxes, is capable of detecting cryptomalware in WebAssembly binaries. However, obfuscation studies have exposed their shortcomings, revealing an almost unexplored area for WebAssembly that threatens malware detection accuracy. In concrete, Bhansali et al.’s seminal work [67] demonstrates that cryptomining algorithm’s source code can evade previous techniques through the use of obfuscation techniques.

WebAssembly malware: Since the introduction of WebAssembly, the Web has consistently experienced an increase in cryptomalware. This rise primarily stems from the shift of mining algorithms from CPUs to WebAssembly, a transition driven by notable performance benefits [66]. Tools such as MineSweeper [26], MinerRay [27], and MINOS [28] employ static analysis with machine learning techniques to detect browser-based cryptomalware. In addition, SEISMIC [29], RAPID [30], and OUTGuard [31] leverage dynamic analysis techniques to achieve a similar objective. Moreover, VirusTotal’®, a tool incorporating over 60 commercial antivirus systems as black-boxes, is capable of detecting cryptomalware in WebAssembly binaries. However, obfuscation studies have exposed their shortcomings, revealing an almost unexplored area for WebAssembly that threatens malware detection accuracy. In concrete, Bhansali et al.’s seminal work [67] demonstrates that cryptomining algorithm’s source code can evade previous techniques through the use of obfuscation techniques.

Suggestions

’

Unpaired symbol: ‘‘’ seems to be missing

Happy suggestion

Suggestions

therefore

delete 'therefore' by ''

Happy suggestion

The techniques discussed previously are primarily focused on reactive analysis of WebAssembly binaries. However, there are approaches to harden WebAssembly binaries, enhancing their secure execution, and thus protecting the security of the entire execution ecosystem. For instance, Swivel [63] proposes a compiler-based strategy designed to eliminate speculative attacks on WebAssembly binaries in Function-as-a-Service (FaaS) platforms by linearizing the machine code from compiling a WebAssembly binary. Similarly, Kolosick et al. [64] modify the Lucet compiler to use zero-cost transitions, eliminating the performance overhead of SFI guarantees implementation. In addition, WaVe [65] introduces a mechanized engine for WebAssembly that facilitates differential testing. WaVe can be employed to detect anomalies in engine implementations running Wasm-WASI programs.

Protecting WebAssembly binaries and runtimes: The techniques discussed previously are primarily focused on reactive analysis of WebAssembly binaries. However, there exist approaches to harden WebAssembly binaries, enhancing their secure execution, and therefore protecting the security of the entire execution ecosystem. For instance, Swivel [63] proposes a compiler-based strategy designed to eliminate speculative attacks on WebAssembly binaries in Function-as-a-Service (FaaS) platforms by linearizing the machine code from compiling a WebAssembly binary. Similarly, Kolosick et al. [64] modify the Lucet compiler to use zero-cost transitions, eliminating the performance overhead of SFI guarantees implementation. In addition, WaVe [65] introduces a mechanized engine for WebAssembly that facilitates differential testing. WaVe can be employed to detect anomalies in engine implementations running Wasm-WASI programs.

Suggestions

thus

their

approaches

replace 'approaches' by 'enhancing'

Happy suggestion

Suggestions

enhancing

exist

replace 'exist' by 'binaries,'

Happy suggestion

Suggestions

binaries,

there

replace 'there' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

However,

replace 'However,' by 'harden'

Happy suggestion

Suggestions

harden

binaries.

replace 'binaries.' by 'to'

Happy suggestion

Suggestions

replace 'of' by 'are'

Happy suggestion

Suggestions

analysis

replace 'analysis' by 'there'

Happy suggestion

Suggestions

there

reactive

replace 'reactive' by 'However,'

Happy suggestion

Suggestions

However,

replace 'on' by 'binaries.'

Happy suggestion

Suggestions

binaries.

focused

replace 'focused' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

primarily

replace 'primarily' by 'of'

and

replace 'and' by 'previously'

Happy suggestion

Suggestions

previously

binaries

replace 'binaries' by 'discussed'

Happy suggestion

Suggestions

discussed

Protecting

replace 'Protecting' by 'The'

Happy suggestion

Suggestions

‘These

delete '‘These' by ''

Happy suggestion

Dynamic analysis involves tools such as TaintAssembly [59], which conducts taint analysis on WebAssembly binaries. Furthermore, Stiévenart et al. Have developed a dynamic approach to slicing WebAssembly programs based on Observational-Based Slicing (ORBS)|[60, 61]. This technique aids in debugging, understanding programs, and conducting security analysis. However, Wasabi [62] remains the only general-purpose dynamic analysis tool for WebAssembly binaries, primarily used for profiling, instrumenting, and debugging WebAssembly code. These tools typically analyze software behavior during execution, making them inherently reactive.

Dynamic analysis: Dynamic analysis involves tools such as TaintAssembly [59], which conducts taint analysis on WebAssembly binaries. Furthermore, Stiévenart et al. have developed a dynamic approach to slicing WebAssembly programs based on Observational-Based Slicing (ORBS)|[60, 61]. This technique aids in debugging, understanding programs, and conducting security analysis. However, Wasabi [62] remains the only general-purpose dynamic analysis tool for WebAssembly binaries, primarily used for profiling, instrumenting, and debugging WebAssembly code. ‘These tools typically analyze software behavior during execution, making them inherently reactive.

Suggestions

code.

delete 'code.' by ''

binaries,

replace 'binaries,' by 'used'

Happy suggestion

Suggestions

used

for

replace 'for' by 'binaries,'

Happy suggestion

Suggestions

binaries,

tool

replace 'tool' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

analysis

replace 'analysis' by 'for'

debugging,

replace 'debugging,' by 'programs,'

Happy suggestion

Suggestions

programs,

replace 'in' by 'understanding'

Happy suggestion

Suggestions

understanding

aids

replace 'aids' by 'debugging,'

Happy suggestion

Suggestions

debugging,

technique

replace 'technique' by 'in'

Suggestions

(ORBS)|[60,

replace 'on' by 'Slicing'

Happy suggestion

Suggestions

Slicing

based

replace 'based' by 'Observational-Based'

Happy suggestion

Suggestions

Observational-Based

WebAssembly

approach

replace 'approach' by 'slicing'

Happy suggestion

Suggestions

slicing

dynamic

replace 'dynamic' by 'to'

Happy suggestion

Suggestions

replace 'a' by 'approach'

Happy suggestion

Suggestions

approach

developed

replace 'developed' by 'dynamic'

Happy suggestion

Suggestions

dynamic

Have

binaries.

analysis

replace 'analysis' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

taint

replace 'taint' by 'on'

Suggestions

which

replace 'as' by '[59],'

Happy suggestion

Suggestions

[59],

such

replace 'such' by 'TaintAssembly'

Happy suggestion

Suggestions

TaintAssembly

tools

replace 'tools' by 'as'

Software diversification.

Software diversification

Suggestions

diversification.

al.

replace 'al.' by 'was'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. The possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. Stiévenart et al. It was suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

replace 'by' by 'Lehmann'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Suggestions

Lehmann

studies

replace 'studies' by 'by'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

inherently

themselves

the

replace 'the' by 'binaries'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Suggestions

binaries

Finally,

replace 'Finally,' by 'the'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Suggestions

[18].

replace '[18].' by 'Finally,'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Suggestions

Finally,

browsers

replace 'browsers' by '[18].'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Suggestions

[18].

replace 'in' by 'browsers'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Suggestions

browsers

binaries

replace 'binaries' by 'in'

the

replace 'the' by 'possibility'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Suggestions

possibility

disclosed

replace 'disclosed' by 'The'

Happy suggestion

Despite progress in WebAssembly analysis, numerous challenges remain. WebAssembly, though deterministic and well-typed by design, is susceptible to a variety of security threats. First, most existing WebAssembly research is reactive, focusing on detecting and fixing vulnerabilities already reported. This approach leaves WebAssembly binaries and runtime implementations potentially open to unidentified attacks. Second, side-channel attacks present a significant risk. Genkin et al., for example, illustrated how WebAssembly could be manipulated to extract data via cache timing-side channels [22]. Furthermore, research conducted by Maisuradze and Rossow demonstrated the potential for speculative execution attacks on WebAssembly binaries [23]. Rokicki et al. disclosed the possibility for port contention side-channel attacks on WebAssembly binaries in browsers [18]. Finally, the binaries themselves may be inherently vulnerable. For example, studies by Lehmann et al. and Stiévenart et al. suggested that flaws in C/C++ source code could infiltrate WebAssembly binaries [20, 21].

Suggestions

challenges

replace 'challenges' by 'challenges.'

Happy suggestion

Open challenges.

Open challenges

Suggestions

challenges.

variants

replace 'variants' by 'variants.'

Happy suggestion

Automatic generation of software variants.

Automatic generation of software variants

Suggestions

variants.

instr1i

Possible typo detected.

Happy suggestion

The concept of automatic software variants starts with Randell’s 1975 work [79], which put forth the notion of artificial fault-tolerant instruction blocks. Artificial Software Diversification, as proposed by Cohen and Forrest in the 1990s [33, 34], gets its development through rewriting strategies. These strategies consist of sets of rewriting rules for modifying software components to create functionally equivalent, yet distinct, programs. Rewriting strategies typically take the form of tuples: instr1i => (instr2, instr3,...), where instr represents the original code and (instr2, instr3,...) denotes the functionally equivalent code.

Suggestions

instr

Reordering:

replace 'Reordering:' by 'Reordering'

Happy suggestion

Instruction Reordering This strategy reorders instructions in a program. For example, variable declarations may change if compilers reorder them in the symbol tables. This prevents static examination and analysis of parameters and alters memory locations. In this area, Bhatkar et al. [83, 84] proposed the random permutation of variable and routine order for ELF binaries. Such strategies are not implemented for WebAssembly to the best of our knowledge.

Instruction Reordering: This strategy reorders instructions in a program. For example, variable declarations may change if compilers reorder them in the symbol tables. This prevents static examination and analysis of parameters and alters memory locations. In this area, Bhatkar et al. [83, 84] proposed the random permutation of variable and routine order for ELF binaries. Such strategies are not implemented for WebAssembly to the best of our knowledge.

Suggestions

Reordering

strategy:

delete 'strategy:' by ''

Happy suggestion

The automatic creation of Software Diversification begins with creating rewriting rules. A rewriting rule refers to a functionally equivalent substitution for a code segment, manually written. These rules can be applied at varying levels, from coarse to fine-grained. This can range from the program dependencies level [80] to the instruction level [75]. For example, Cleemput et al. [81] and Homescu et al. [82] inject NOP instructions to yield statically varied versions at the instruction level. Here, the rewriting rule is represented as instr => (nop instr), signifying an insertion of a nop operation preceding the instruction.

Rewriting strategy: The automatic creation of Software Diversification begins with creating rewriting rules. A rewriting rule refers to a functionally equivalent substitution for a code segment, manually written. These rules can be applied at varying levels, from coarse to fine-grained. This can range from the program dependencies level [80] to the instruction level [75]. For example, Cleemput et al. [81] and Homescu et al. [82] inject NOP instructions to yield statically varied versions at the instruction level. Here, the rewriting rule is represented as instr => (nop instr), signifying an insertion of a nop operation preceding the instruction.

Suggestions

Rewriting

delete 'Rewriting' by ''

Happy suggestion

Suggestions

implement

replace 'implement' by 'Implement'

Happy suggestion

ISA Randomization and Simulation: This strategy involves using a key to cipher the original program binary into another encoded binary. Once encoded, the program can only be decoded at the target client, or it can be interpreted in the encoded form using a custom virtual machine implementation. This technique is strong against attacks involving code inspection. Kc et al. [92], and Barrantes et al. [93] proposed seminal works on instruction-set randomization to create a unique mapping between artificial CPU instructions and real ones. On the same topic, Chew and Song [94] target operating system randomization. They randomize the interface between the operating system and the user applications. Couroussé et al. [95] Implement an assembly-like DSL to generate equivalent code at runtime in order to increase protection against side-channel attacks. Their technique generates a different program during execution using an interpreter for their DSL. Generally, [SA randomization and simulation usually faces a performance penalty, especially for WebAssembly, due to the decoding process as shown in WASMixer evaluation [96].

ISA Randomization and Simulation: This strategy involves using a key to cipher the original program binary into another encoded binary. Once encoded, the program can only be decoded at the target client, or it can be interpreted in the encoded form using a custom virtual machine implementation. This technique is strong against attacks involving code inspection. Kc et al. [92], and Barrantes et al. [93] proposed seminal works on instruction-set randomization to create a unique mapping between artificial CPU instructions and real ones. On the same topic, Chew and Song [94] target operating system randomization. They randomize the interface between the operating system and the user applications. Couroussé et al. [95] implement an assembly-like DSL to generate equivalent code at runtime in order to increase protection against side-channel attacks. Their technique generates a different program during execution using an interpreter for their DSL. Generally, [SA randomization and simulation usually faces a performance penalty, especially for WebAssembly, due to the decoding process as shown in WASMixer evaluation [96].

Suggestions

Implement

[

Unpaired symbol: ‘]’ seems to be missing

Happy suggestion

ISA Randomization and Simulation: This strategy involves using a key to cipher the original program binary into another encoded binary. Once encoded, the program can only be decoded at the target client, or it can be interpreted in the encoded form using a custom virtual machine implementation. This technique is strong against attacks involving code inspection. Kc et al. [92], and Barrantes et al. [93] proposed seminal works on instruction-set randomization to create a unique mapping between artificial CPU instructions and real ones. On the same topic, Chew and Song [94] target operating system randomization. They randomize the interface between the operating system and the user applications. Couroussé et al. [95] implement an assembly-like DSL to generate equivalent code at runtime in order to increase protection against side-channel attacks. Their technique generates a different program during execution using an interpreter for their DSL. Generally, [SA randomization and simulation usually faces a performance penalty, especially for WebAssembly, due to the decoding process as shown in WASMixer evaluation [96].

Suggestions

Yet,

delete 'Yet,' by ''

Happy suggestion

Code obfuscation: Code obfuscation can be seen as a simplification of [S'A randomization. The main difference between encoding and obfuscating code is that the latter requires the final target to know the encoding key while the latter executes as is in any client [97]. Yet, both strategies aim to tackle static reverse engineering of programs. In the context of WebAssembly, Romano et al. [87] proposed an obfuscation technique, wobfuscator, for JavaScript in which part of the code is replaced by calls to complementary WebAssembly functions. Yet, the wobfuscator targets JavaScript code, not WebAssembly binaries.

Code obfuscation: Code obfuscation can be seen as a simplification of [S'A randomization. The main difference between encoding and obfuscating code is that the former requires the final target to know the encoding key while the latter executes as is in any client [97]. Yet, both strategies aim to tackle static reverse engineering of programs. In the context of WebAssembly, Romano et al. [87] proposed an obfuscation technique, wobfuscator, for JavaScript in which part of the code is replaced by calls to complementary WebAssembly functions. Yet, wobfuscator targets JavaScript code, not WebAssembly binaries.

calls

replace 'calls' by 'Yet,'

Happy suggestion

Suggestions

Yet,

replace 'by' by 'functions.'

Happy suggestion

Suggestions

functions.

replaced

replace 'replaced' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

replace 'is' by 'complementary'

Happy suggestion

Suggestions

complementary

replaced

which

replace 'which' by 'is'

Happy suggestion

Suggestions

replace 'in' by 'code'

Happy suggestion

Suggestions

code

part

technique,

replace 'technique,' by 'which'

Happy suggestion

Suggestions

which

obfuscation

replace 'obfuscation' by 'in'

Happy suggestion

Suggestions

replace 'an' by 'JavaScript'

Happy suggestion

Suggestions

JavaScript

proposed

replace 'proposed' by 'for'

Happy suggestion

Suggestions

[87]

replace '[87]' by 'wobfuscator,'

Happy suggestion

Suggestions

wobfuscator,

al.

replace 'al.' by 'technique,'

Happy suggestion

Suggestions

technique,

replace 'et' by 'obfuscation'

Happy suggestion

Suggestions

obfuscation

[87]

context

replace 'context' by 'al.'

tackle

replace 'tackle' by 'of'

Happy suggestion

Suggestions

replace 'to' by 'engineering'

Happy suggestion

Suggestions

engineering

aim

replace 'aim' by 'reverse'

Happy suggestion

Suggestions

reverse

strategies

replace 'strategies' by 'static'

Happy suggestion

Suggestions

static

both

replace 'both' by 'tackle'

Happy suggestion

Suggestions

tackle

strategies

client

executes

encoding

replace 'encoding' by 'latter'

Happy suggestion

Suggestions

latter

know

delete 'know' by ''

Happy suggestion

Suggestions

replace 'to' by 'while'

Happy suggestion

Suggestions

while

target

former

replace 'former' by 'final'

Happy suggestion

Suggestions

final

insert '' by 'requires'

Happy suggestion

Suggestions

requires

that

obfuscating

replace 'obfuscating' by 'is'

Suggestions

replace 'of' by 'randomization.'

Happy suggestion

Suggestions

randomization.

simplification

replace 'simplification' by '[S'A'

Happy suggestion

Suggestions

[S'A

replace 'a' by 'of'

Happy suggestion

Suggestions

replace 'as' by 'simplification'

Happy suggestion

Suggestions

simplification

seen

replace 'seen' by 'a'

Happy suggestion

Suggestions

replace 'be' by 'as'

Happy suggestion

Suggestions

can

replace 'can' by 'seen'

Happy suggestion

Suggestions

seen

Code

[

Unpaired symbol: ‘]’ seems to be missing

Happy suggestion

Suggestions

insert '' by 'Checking:'

Happy suggestion

Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking: Equivalence Checking

Equivalence Checking

Suggestions

Checking:

insert '' by 'Equivalence'

Happy suggestion

Equivalence Checking

Suggestions

Equivalence

deployment

replace 'deployment' by 'deployment.'

Happy suggestion

Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment. Variants deployment.

Variants deployment

Suggestions

deployment.

insert '' by 'deployment.'

Happy suggestion

Variants deployment

Suggestions

deployment.

insert '' by 'Variants'

Happy suggestion

Variants deployment

Suggestions

Variants

verification:

delete 'verification:' by ''

Happy suggestion

propose

delete 'propose' by ''

Happy suggestion

In the context of our work, the term Randomization denotes a program’s ability to present different variants to different clients. In this setup, a program, randomly selected from a collection of variants (referred to as the program’s variant pool), is assigned to a client during each deployment. Jackson et al. [73] define the variant pool in Randomization as herd immunity, as vulnerable binaries can only affect a segment of the client community. El-Khalil et al. [110] suggest employing a custom compiler to generate varying binaries from the compilation process. They adapt a version of GCC 4.1 to partition a conventional stack into several component parts, termed multistacks. Similarly, Singhal et al. propose Cornucopia [111]. Cornucopia generates multiple variants of a program by using different compiler flag combinations. Aga et al. Propose the generation of program variants through the randomization of its data layout in memory [88]. This method allows each variant to operate on the same data in memory but at different memory offsets. Randomization can also be applied to virtual machines and operating systems. On this note, Kc et al. [92] establish a unique mapping between artificial CPU instructions and actual ones, enabling the assignment of various variants to specific target clients. In a similar vein, Xu et al. [91] recompile the Linux Kernel to minimize the exposure time of persistent memory objects, thereby increasing the frequency of address randomization.

Randomization: In the context of our work, the term Randomization denotes a program’s ability to present different variants to different clients. In this setup, a program, randomly chosen from a collection of variants (referred to as the program’s variant pool), is assigned to a the client during each deployment. Jackson et al. [73] define the variant pool in Randomization as herd immunity, as vulnerable binaries can only affect a segment of the client community. El-Khalil et al. [110] suggest employing a custom compiler to generate varying binaries from the compilation process. They adapt a version of GCC 4.1 to partition a conventional stack into several component parts, termed multistacks. Similarly, Singhal et al., propose Cornucopia [111]. Cornucopia generates multiple variants of a program by using different compiler flag combinations. Aga et al. propose the generation of program variants through the randomization of its data layout in memory [88]. This method allows each variant to operate on the same data in memory but at different memory offsets. Randomization can also be applied to virtual machines and operating systems. On this note, Kc et al. [92] establish a unique mapping between artificial CPU instructions and actual ones, enabling the assignment of various variants to specific target clients. In a similar vein, Xu et al. [91] recompile the Linux Kernel to minimize the exposure time of persistent memory objects, thereby increasing the frequency of address randomization.

Suggestions

al.

delete 'al.' by ''

Happy suggestion

Suggestions

delete 'et' by ''

Happy suggestion

Suggestions

Aga

replace 'Aga' by 'Propose'

Happy suggestion

Suggestions

Propose

combinations.

using

replace 'using' by 'flag'

Happy suggestion

Suggestions

flag

replace 'by' by 'compiler'

Happy suggestion

Suggestions

compiler

program

multiple

replace 'multiple' by 'a'

Happy suggestion

Suggestions

generates

replace 'generates' by 'of'

Suggestions

[111].

replace 'et' by 'Cornucopia'

Happy suggestion

Suggestions

Cornucopia

Singhal

replace 'Singhal' by 'propose'

Happy suggestion

Suggestions

propose

Similarly,

replace 'Similarly,' by 'al.'

Happy suggestion

Suggestions

multistacks.

replace 'multistacks.' by 'et'

Suggestions

several

replace 'a' by 'into'

Happy suggestion

Suggestions

into

partition

replace 'partition' by 'stack'

Happy suggestion

Suggestions

stack

replace 'to' by 'conventional'

Happy suggestion

Suggestions

conventional

process.

replace 'process.' by 'a'

Suggestions

generate

replace 'generate' by 'from'

Happy suggestion

Suggestions

from

replace 'to' by 'binaries'

Happy suggestion

Suggestions

binaries

compiler

replace 'compiler' by 'varying'

Happy suggestion

Suggestions

varying

compiler

suggest

replace 'suggest' by 'custom'

Happy suggestion

Suggestions

custom

suggest

El-Khalil

replace 'El-Khalil' by '[110]'

Happy suggestion

Suggestions

[110]

community.

segment

can

replace 'can' by 'a'

Happy suggestion

Suggestions

binaries

replace 'binaries' by 'affect'

Happy suggestion

Suggestions

affect

binaries

herd

replace 'herd' by 'vulnerable'

Happy suggestion

Suggestions

vulnerable

Randomization

delete 'Randomization' by ''

Happy suggestion

Suggestions

replace 'in' by 'immunity,'

Happy suggestion

Suggestions

immunity,

pool

replace 'pool' by 'herd'

Happy suggestion

Suggestions

herd

variant

replace 'variant' by 'as'

define

deployment.

replace 'deployment.' by '[73]'

Happy suggestion

Suggestions

[73]

Jackson

during

assigned

program’s

variants

from

replace 'from' by 'of'

Happy suggestion

Suggestions

chosen

replace 'chosen' by 'collection'

Happy suggestion

Suggestions

collection

selected

setup,

replace 'setup,' by 'randomly'

Happy suggestion

Suggestions

randomly

setup,

clients.

different

denotes

replace 'denotes' by 'present'

Happy suggestion

Suggestions

present

Randomization

replace 'Randomization' by 'to'

Randomization

insert '' by 'of'

Happy suggestion

Suggestions

insert '' by 'context'

Happy suggestion

Suggestions

context

Suggestions

al.

delete 'al.' by ''

Happy suggestion

Suggestions

memory

replace 'memory' by 'al.'

Happy suggestion

Suggestions

replace 'of' by 'et'

Suggestions

allowing

that

replace 'that' by 'direction,'

Happy suggestion

Suggestions

direction,

grows

These

replace 'These' by 'that'

Happy suggestion

Suggestions

that

variants.

replace 'variants.' by 'stack'

Happy suggestion

Suggestions

stack

Intel

replace 'Intel' by 'a'

Happy suggestion

Suggestions

32-bit

replace '32-bit' by 'have'

Happy suggestion

Suggestions

have

generate

replace 'generate' by 'variants'

Happy suggestion

Suggestions

variants

replace 'to' by 'These'

Happy suggestion

Suggestions

These

library

replace 'library' by 'variants.'

Happy suggestion

Suggestions

variants.

standard

replace 'standard' by 'Intel'

Happy suggestion

Suggestions

Intel

replace 'a' by '32-bit'

Happy suggestion

Suggestions

32-bit

modify

replace 'modify' by 'generate'

Happy suggestion

Suggestions

generate

al.

replace 'al.' by 'to'

Happy suggestion

Suggestions

replace 'et' by 'library'

Happy suggestion

Suggestions

library

Salamat

replace 'Salamat' by 'standard'

Happy suggestion

Suggestions

standard

time,

replace 'time,' by 'a'

Happy suggestion

Suggestions

same

replace 'same' by 'Modify'

Happy suggestion

Suggestions

Modify

the

replace 'the' by 'al.'

Happy suggestion

Suggestions

replace 'At' by 'et'

[113].

introducing

replace 'introducing' by 'layouts'

Happy suggestion

Suggestions

layouts

parallel,

replace 'parallel,' by 'memory'

Happy suggestion

Suggestions

memory

replace 'in' by 'randomized'

Happy suggestion

Suggestions

randomized

variants

replace 'variants' by 'and'

Happy suggestion

Suggestions

two

replace 'two' by 'non-overlapping'

Happy suggestion

Suggestions

non-overlapping

executing

replace 'executing' by 'introducing'

Happy suggestion

Suggestions

introducing

replace 'of' by 'parallel,'

Happy suggestion

Suggestions

parallel,

concept

replace 'concept' by 'in'

Happy suggestion

Suggestions

the

replace 'the' by 'variants'

Happy suggestion

Suggestions

variants

concept

[83].

replace '[83].' by 'the'

Happy suggestion

Suggestions

paths

replace 'paths' by 'Extended'

Happy suggestion

Suggestions

Extended

execution

replace 'execution' by 'al.'

replace 'single' by 'paths'

Happy suggestion

Suggestions

paths

replace 'a' by 'execution'

Happy suggestion

Suggestions

execution

replace 'as' by 'randomize'

Happy suggestion

Suggestions

randomize

replace 'or' by 'to'

Suggestions

replace 'to' by 'as'

replace 'can' by 'to'

Happy suggestion

Suggestions

variants

replace 'variants' by 'parallel'

Happy suggestion

Suggestions

parallel

embedded

replace 'embedded' by 'in'

Happy suggestion

Suggestions

These

replace 'These' by 'execute'

Happy suggestion

Suggestions

execute

insert '' by 'These'

Happy suggestion

Suggestions

These

insert '' by 'runtime.'

Happy suggestion

Suggestions

runtime.

its

replace 'its' by 'at'

Suggestions

Then,

replace 'Then,' by 'executes'

Happy suggestion

Suggestions

executes

Then,

randomly

[112].

replace '[112].' by 'is'

Happy suggestion

Suggestions

delete 'a' by ''

Happy suggestion

Suggestions

replace 'as' by 'Each'

Happy suggestion

Suggestions

Each

known

replace 'known' by '[112].'

Happy suggestion

Suggestions

[112].

binary,

replace 'binary,' by 'binary'

Happy suggestion

Suggestions

binary

single

replace 'single' by 'multivariant'

Happy suggestion

Suggestions

multivariant

insert '' by 'as'

Happy suggestion

Suggestions

insert '' by 'known'

Happy suggestion

Suggestions

known

into

replace 'into' by 'binary,'

Happy suggestion

Suggestions

binary,

composed

replace 'composed' by 'single'

Happy suggestion

Suggestions

single

are

replace 'are' by 'a'

Suggestions

(MVE):

replace '(MVE):' by 'variants'

Happy suggestion

Suggestions

variants

Execution

replace 'Execution' by 'program'

Happy suggestion

Suggestions

program

Diversification

replace 'Diversification' by 'Diversification.'

Happy suggestion

Measuring Software Diversification.

Measuring Software Diversification

Suggestions

Diversification.

that,

replace 'that,' by 'that'

Happy suggestion

Dynamic comparison of variants: Static comparisons between variants inherently have limitations. For example, two variants may show differences at the source code level but exhibit identical behavior during execution. Take the addition of nop operations to a program as an example. Despite source code level differences, the variant and the original program execute identical instructions, leading to similar behaviors modulo input. Measuring Software Diversification primarily aims to demonstrate variant-specific observabilities. While static differences are usually observable, runtime information holds complementary relevance [125]. Therefore, dynamic metrics are essential to assess the diversity of variants. For instance, Forrest et al. [126] were pioneers in classifying program behaviors by analyzing their system call traces using n-grams profiling. Cabrera et al. Use a global alignments approach to gauge the diversity of JavaScript bytecode traces within the Chrome browser [14]. Fang et al. proposed a method to counteract JavaScript obfuscation techniques used in malicious code, by analyzing dynamic information captured from V8 bytecode traces [127]. Dynamic metrics are primarily employed to cluster similar behaviors. Following the same logic, the diversity is greater when the difference between behaviors is larger. Notice that dynamic metrics can be difficult due to the expense of program execution or the complication of required user interaction. On the other hand, malware programs, which usually do not require user interaction, are simpler to evaluate in controlled environments before actual deployment.

Dynamic comparison of variants: Static comparisons between variants inherently have limitations. For example, two variants may show differences at the source code level but exhibit identical behavior during execution. Take the addition of nop operations to a program as an instance. Despite source code level differences, the variant and the original program execute identical instructions, leading to similar behaviors modulo input. Measuring Software Diversification primarily aims to demonstrate variant-specific observabilities. While static differences are usually observable, runtime information holds complementary relevance [125]. Therefore, dynamic metrics are essential to assess the diversity of variants. For instance, Forrest et al. [126] were pioneers in classifying program behaviors by analyzing their system call traces using n-grams profiling. Cabrera et al. used a global alignments approach to gauge the diversity of JavaScript bytecode traces within the Chrome browser [14]. Fang et al. proposed a method to counteract JavaScript obfuscation techniques used in malicious code, by analyzing dynamic information captured from V8 bytecode traces [127]. Dynamic metrics are primarily employed to cluster similar behaviors. Following the same logic, the diversity is greater when the difference between behaviors is larger. Notice that, dynamic metrics can be difficult due to the expense of program execution or the complication of required user interaction. On the other hand, malware programs, which usually do not require user interaction, are simpler to evaluate in controlled environments before actual deployment.

Suggestions

that

used

replace 'used' by 'Use'

Happy suggestion

Dynamic comparison of variants: Static comparisons between variants inherently have limitations. For example, two variants may show differences at the source code level but exhibit identical behavior during execution. Take the addition of nop operations to a program as an instance. Despite source code level differences, the variant and the original program execute identical instructions, leading to similar behaviors modulo input. Measuring Software Diversification primarily aims to demonstrate variant-specific observabilities. While static differences are usually observable, runtime information holds complementary relevance [125]. Therefore, dynamic metrics are essential to assess the diversity of variants. For instance, Forrest et al. [126] were pioneers in classifying program behaviors by analyzing their system call traces using n-grams profiling. Cabrera et al. used a global alignments approach to gauge the diversity of JavaScript bytecode traces within the Chrome browser [14]. Fang et al. proposed a method to counteract JavaScript obfuscation techniques used in malicious code, by analyzing dynamic information captured from V8 bytecode traces [127]. Dynamic metrics are primarily employed to cluster similar behaviors. Following the same logic, the diversity is greater when the difference between behaviors is larger. Notice that, dynamic metrics can be difficult due to the expense of program execution or the complication of required user interaction. On the other hand, malware programs, which usually do not require user interaction, are simpler to evaluate in controlled environments before actual deployment.

Suggestions

instance.

replace 'instance.' by 'example.'

Happy suggestion

Dynamic comparison of variants: Static comparisons between variants inherently have limitations. For example, two variants may show differences at the source code level but exhibit identical behavior during execution. Take the addition of nop operations to a program as an instance. Despite source code level differences, the variant and the original program execute identical instructions, leading to similar behaviors modulo input. Measuring Software Diversification primarily aims to demonstrate variant-specific observabilities. While static differences are usually observable, runtime information holds complementary relevance [125]. Therefore, dynamic metrics are essential to assess the diversity of variants. For instance, Forrest et al. [126] were pioneers in classifying program behaviors by analyzing their system call traces using n-grams profiling. Cabrera et al. used a global alignments approach to gauge the diversity of JavaScript bytecode traces within the Chrome browser [14]. Fang et al. proposed a method to counteract JavaScript obfuscation techniques used in malicious code, by analyzing dynamic information captured from V8 bytecode traces [127]. Dynamic metrics are primarily employed to cluster similar behaviors. Following the same logic, the diversity is greater when the difference between behaviors is larger. Notice that, dynamic metrics can be difficult due to the expense of program execution or the complication of required user interaction. On the other hand, malware programs, which usually do not require user interaction, are simpler to evaluate in controlled environments before actual deployment.

Suggestions

example.

delete 'Offensive' by ''

Happy suggestion

Suggestions

Diversification

delete 'Diversification' by ''

Happy suggestion

Lundquist et al. [75] distinguish Software Diversification into two categories: defensive and offensive. On the one hand, defensive software diversification introduces unpredictability in system behavior. By making software less predictable, defensive Software Diversification aims to proactively deter attacks, acting as a complementary strategy to other, more reactive, security measures. The majority of previously discussed works in this section contribute to defensive diversification. Yet, Software Diversification that aims to create diverse harmful programs is considered Offensive Diversification [129].

Lundquist et al. [75] distinguish Software Diversification into two categories: Defensive and Offensive Diversification. On the one hand, Defensive Software Diversification introduces unpredictability in system behavior. By making software less predictable, defensive Software Diversification aims to proactively deter attacks, acting as a complementary strategy to other, more reactive, security measures. The majority of previously discussed works in this section contribute to defensive diversification. Yet, Software Diversification that aims to create diverse harmful programs is considered Offensive Diversification [129].

Defensive

replace 'Defensive' by 'defensive'

Happy suggestion

Suggestions

defensive

diversification

replace 'diversification' by 'diversification.'

Happy suggestion

Offensive or defensive assessment of diversification.

Offensive or Defensive assessment of diversification

Suggestions

diversification.

Defensive

replace 'Defensive' by 'defensive'

Happy suggestion

Offensive or defensive assessment of diversification.

Offensive or Defensive assessment of diversification

Suggestions

defensive

Diversification

replace 'Diversification' by 'Diversification.'

Happy suggestion

Open challenges for Software Diversification.

Open challenges for Software Diversification

Suggestions

Diversification.

«¢

delete '«¢' by ''

Happy suggestion

Foo |. ) Wasm /> , 1 _»-—+t i 1 ! ' i Wasm Source Frontend 1 Optimizer/ ' Code ‘Transformer ! ‘ ee i a Backend i wasm-mutate ' toa ' wwe i Se nay — , 1 f brow Binary Saawess ie ae eaeaee ot re

fooo |. ) Wasm , 1 _»-—+t i 1 ! ' i Wasm Source Frontend 1 Optimizer/ ' Code ‘Transformer ! ‘ { ee i a Backend i wasm-mutate ' toa ' wwe i Se nay — , 1 f brow Binary Saawess ie ae eaeaee ot re ° based ' 1 ' ' | Compiler ' | based i Multivariant j ' Wasm j ' 1 ‘ 1 ‘ MEWE «¢

Suggestions

‘

delete '‘' by ''

Happy suggestion

Suggestions

delete '1' by ''

Happy suggestion

Suggestions

delete ''' by ''

Source code, which is then processed by a compiler to produce a WebAssembly binary. This compiler is generally divided into three main components [139]: a frontend that converts the source code into an intermediate representation, a transformer that modifies this representation usually for performance, and a backend that compiles the final WebAssembly binary. This architecture is illustrated in the leftmost part of Figure 3.1. The process of generating WebAssembly binaries starts with the original source code.

source code, which is then processed by a compiler to produce a WebAssembly binary. This compiler is generally divided into three main components [139]: a frontend that converts the source code into an intermediate representation, a transformer that modifies this representation usually for performance, and a backend that compiles the final WebAssembly binary. This architecture is illustrated in the leftmost part of Figure 3.1. i process of generating WebAssembly binaries starts with the original

Suggestions

code.

insert '' by 'source'

Happy suggestion

Suggestions

source

replace 'i' by 'The'

— David Wheeler.

— David Wheeler

Suggestions

Wheeler.

FOR

delete 'FOR' by ''

Happy suggestion

AUTOMATIC SOFTWARE DIVERSIFICATION FOR AUTOMATIC SOFTWARE DIVERSIFICATION FOR AUTOMATIC SOFTWARE DIVERSIFICATION FOR AUTOMATIC SOFTWARE DIVERSIFICATION FOR AUTOMATIC SOFTWARE DIVERSIFICATION FOR AUTOMATIC SOFTWARE DIVERSIFICATION FOR AUTOMATIC SOFTWARE DIVERSIFICATION FOR AUTOMATIC SOFTWARE DIVERSIFICATION FOR AUTOMATIC SOFTWARE DIVERS

AUTOMATIC SOFTWARE DIVERSIFICATION FOR

Suggestions

DIVERSIFICATION

replace 'DIVERSIFICATION' by 'DIVERS'

Happy suggestion

AUTOMATIC SOFTWARE DIVERSIFICATION FOR

Suggestions

DIVERS

insert '' by 'FOR'

Happy suggestion

AUTOMATIC SOFTWARE DIVERSIFICATION FOR

AUTOMATIC

synthesis

replace 'synthesis' by 'synthesis.'

Happy suggestion

Enumerative synthesis.

Enumerative synthesis

Suggestions

synthesis.

insert '' by 'Functions'

Happy suggestion

Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions: Functions

Function

Suggestions

Functions

insert '' by 'Functions:'

Happy suggestion

Function

Suggestions

Functions:

Function

replace 'Function' by 'Functions:'

Happy suggestion

Function

Suggestions

Functions:

transformations

replace 'transformations' by 'transformations.'

Happy suggestion

CROW is carefully designed to boost the generation of variants as much as possible. First, we disable the majority of the pruning strategies. Instead of preventing the generation of commutative operations during the search, CROW still uses such transformation as a strategy to generate program variants. Second, CROW applies code transformations independently. For instance, if a suitable replacement is identified that can be applied at N different locations in the original program, CROW will generate 2" distinct program variants, i.e., the power set of applying the transformation or not to each location. This approach leads to a combinatorial explosion in the number of available program variants, especially as the number of possible replacements increases. Third, we remove all built-in optimizations in the LLVM backend that could reverse Wasm variants, i.e., we disable all optimizations in the Wasm backend that could reverse the CROW transformations.

Suggestions

transformations.

delete '0' by ''

Happy suggestion

Suggestions

delete '3' by ''

Happy suggestion

Suggestions

delete '>' by ''

Happy suggestion

Suggestions

current)

replace 'current)' by ';'

Happy suggestion

Suggestions

;

%d\n",

replace '%d\n",' by '0'

Happy suggestion

Suggestions

replace 'is' by 'return'

Happy suggestion

Suggestions

return

current)

25264;

replace '25264;' by '%dn",'

Happy suggestion

Suggestions

%dn",

replace '=' by 'is'

Suggestions

[40].

replace '[40].' by 'current'

Happy suggestion

Suggestions

current

from

replace 'from' by 'int'

Happy suggestion

Suggestions

Taken

replace 'Taken' by 'babbage()'

Happy suggestion

Suggestions

babbage()

problem.

replace 'problem.' by 'Int'

Suggestions

problem.

replace '0' by 'Babbage'

Happy suggestion

Suggestions

Babbage

current);

number

replace 'number' by '7%dn",'

Happy suggestion

Suggestions

7%dn",

("The

current++;

replace 'current++;' by 'printf'

Happy suggestion

Suggestions

printf

269696)

((square=current*current)

current

{}

replace '{}' by 'int'

Happy suggestion

Suggestions

inferring

replace 'inferring' by 'inferring.'

Happy suggestion

Constant inferring.

Constant inferring

Suggestions

inferring.

insert '' by 'NO'

Happy suggestion

NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO NO

Suggestions

)

Unpaired symbol: ‘(’ seems to be missing

Happy suggestion

1 2 3 ing £Cint =) 4 return 2 * x + x; a Listing 3.3: C function that calculates the quantity 2x + x.

Suggestions

runtime?.

replace 'runtime?.' by 'runtime?'

Happy suggestion

CROW deals with this case, generating the program in Listing 3.2. It infers the value of current in Line 2 such that the Babbage condition is reached! Therefore, the condition in the loop will always be false. Then, the loop is dead code and is removed in the final compilation. The new program in Listing 3.2 is remarkably smaller and faster than the original code. Therefore, it offers differences both statically and at runtime?

CROW deals with this case, generating the program in Listing 3.2. It infers the value of current in Line 2 such that the Babbage condition is reached!. Therefore, the condition in the loop will always be false. Then, the loop is dead code and is removed in the final compilation. The new program in Listing 3.2 is remarkably smaller and faster than the original code. Therefore, it offers differences both statically and at runtime?.

Suggestions

runtime?

reached!.

replace 'reached!.' by 'reached!'

Happy suggestion

Suggestions

reached!

?Notice

replace '?Notice' by 'Note'

Suggestions

Notice

132.mul

replace '132.mul' by '132.mules.'

Happy suggestion

func $f (param i32) (result i32) local.get 0 1i32.const 3 132.mules.

func $f (param i32) (result i32) local.get 0 1i32.const 3 132.mul

Suggestions

132.mules.

get

If a new sentence starts here, add a space and start with an uppercase letter.

Happy suggestion

func $f (param i32) (result i32) local.get 0 1i32.const 3 132.mul

Suggestions

i32.add

replace 'i32.add' by 'i32'

Happy suggestion

func $f (param i32) (result i32) local.get 0 local.get 0 1i32.add local.get 0 i32.add local.get 0 i32.add local.get 0 i32.add local.get 0 i32.add local.get 0 i32.add local.get 0 i32.add local.get 0 i32.add local.get 0 i32

func $f (param i32) (result i32) local.get 0 local.get 0 1i32.add local.get 0 i32.add

Suggestions

insert '' by 'local.get'

Happy suggestion

func $f (param i32) (result i32) local.get 0 local.get 0 1i32.add local.get 0 i32.add

Suggestions

local.get

insert '' by '1i32.add'

Happy suggestion

func $f (param i32) (result i32) local.get 0 local.get 0 1i32.add local.get 0 i32.add

Suggestions

1i32.add

i32)

get

If a new sentence starts here, add a space and start with an uppercase letter.

Happy suggestion

func $f (param i32) (result i32) local.get 0 local.get 0 1i32.add local.get 0 i32.add

Suggestions

i32.add

delete 'i32.add' by ''

Happy suggestion

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add

Suggestions

replace '0' by 'i32.'

Happy suggestion

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add

Suggestions

i32.

local.get

replace 'local.get' by 'i32.add'

Happy suggestion

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add

Suggestions

i32.add

132.shl1

replace '132.shl1' by '0'

Happy suggestion

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add

Suggestions

replace '1' by 'local.get'

Happy suggestion

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add

Suggestions

local.get

132.const

i32)

get

If a new sentence starts here, add a space and start with an uppercase letter.

Happy suggestion

func $f (param i32) (result i32) local.get 0 132.const 1 132.shl1 local.get 0 i32.add

Suggestions

i32.add

delete 'i32.add' by ''

Happy suggestion

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add

Suggestions

replace '0' by 'i32.'

Happy suggestion

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add

Suggestions

i32.

local.get

replace 'local.get' by 'i32.add'

Happy suggestion

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add

Suggestions

i32.add

i132.mul

replace 'i132.mul' by '0'

Happy suggestion

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add

Suggestions

replace '2' by 'local.get'

Happy suggestion

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add i32.

func $f (param i32) (result i32) local.get 0 1i32.const 2 i132.mul local.get 0 i32.add

Suggestions

local.get

1i32.const

i32)

get

If a new sentence starts here, add a space and start with an uppercase letter.

Happy suggestion

h2 = 13 mul nsw i32 %0,2 add nsw i32 %0,%2

Suggestions

insert '' by '%0,%2'

Happy suggestion

h2 = 13 mul nsw i32 %0,2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %

h2 = 13 mul nsw i32 %0,2 add nsw i32 %0,%2

Suggestions

%0,%2

insert '' by 'i32'

Happy suggestion

h2 = 13 mul nsw i32 %0,2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %

h2 = 13 mul nsw i32 %0,2 add nsw i32 %0,%2

Suggestions

insert '' by 'nsw'

Happy suggestion

h2 = 13 mul nsw i32 %0,2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %0,%2 add nsw i32 %

h2 = 13 mul nsw i32 %0,2 add nsw i32 %0,%2

1:i32.

i132

@f(i32

{

Don’t put a space after the opening parenthesis.

Happy suggestion

define i32 @main() { %1 = tail call i32 @f(i32 10) ret i132 %1} 72 = shl nsw i32 %0, 1:i32

Suggestions

{

for_code1___code_2__.

Replacement

replace 'Replacement' by 'for'

Happy suggestion

define i32 @f(i32) Replacement candidates Replacement candidates for for_code1___code_2__.

define i32 @f(i32) { Replacement candidates Replacement candidates for for_code1___code_2

Suggestions

insert '' by 'candidates'

Happy suggestion

define i32 @f(i32) Replacement candidates Replacement candidates for for_code1___code_2__.

define i32 @f(i32) { Replacement candidates Replacement candidates for for_code1___code_2

Suggestions

candidates

{

replace '{' by 'Replacement'

Happy suggestion

define i32 @f(i32) Replacement candidates Replacement candidates for for_code1___code_2__.

define i32 @f(i32) { Replacement candidates Replacement candidates for for_code1___code_2

Suggestions

Replacement

3.6:

delete '3.6:' by ''

Happy suggestion

Wasm program variants generated from program Listing 3.8.

Listing 3.6: Wasm program variants generated from program Listing 3.8.

Suggestions

Listing

delete 'Listing' by ''

Happy suggestion

Wasm program variants generated from program Listing 3.8.

Listing 3.6: Wasm program variants generated from program Listing 3.8.

Suggestions

respectively

replace 'respectively' by 'respectively,'

Happy suggestion

CROW detects code_1 and code_2 as the enclosing boxes in the leftmost part of Listing 3.4 show. CROW synthesizes 2 + 1 candidate code replacements for each code, respectively, as the green highlighted lines show in the rightmost parts of Listing 3.4. The baseline strategy of CROW is to generate variants out of all possible combinations of the candidate code replacements, 7.e., uses the power set of all candidate code replacements.

CROW, detects code_1 and code_2 as the enclosing boxes in the leftmost part of Listing 3.4 shows. CROW synthesizes 2 + 1 candidate code replacements for each code respectively as the green highlighted lines show in the rightmost parts of Listing 3.4. The baseline strategy of CROW is to generate variants out of all possible combinations of the candidate code replacements, 7.e., uses the power set of all candidate code replacements.

Suggestions

respectively,

code

replace 'code' by 'code,'

Happy suggestion

Suggestions

code,

shows.

replace 'shows.' by 'show.'

Happy suggestion

Suggestions

show.

CROW,

replace 'CROW,' by 'CROW'

Happy suggestion

Suggestions

CROW

https://github.com/ASSERT-KTH/slumps

replace 'https://github.com/ASSERT-KTH/slumps' by 'https://github.com/ASSERT-KTH/slumps.'

Happy suggestion

Contribution paper and artifact CROW is a compiler-based approach. It leverages enumerative synthesis to generate functionally equivalent code replacements and assemble them into diverse Wasm program variants. CROW uses SMT solvers to guarantee functional equivalence. CROW is fully presented in Cabrera-Arteaga et al. “CROW: Code Randomization of WebAssembly” at proceedings of Measurements, Attacks, and Defenses for the Web (MADWeb), NDSS 2021 https://doi.org/10.14722/madweb. 2021. 23004. CROW source code is available at https://github.com/ASSERT-KTH/slumps.

Contribution paper and artifact CROW is a compiler-based approach. It leverages enumerative synthesis to generate functionally equivalent code replacements and assembles them into diverse Wasm program variants. CROW uses SMT solvers to guarantee functional equivalence. CROW is fully presented in Cabrera-Arteaga et al. “CROW: Code Randomization of WebAssembly” at proceedings of Measurements, Attacks, and Defenses for the Web (MADWeb), NDSS 2021 https://doi.org/10.14722/madweb. 2021. 23004. CROW source code is available at https://github.com/ASSERT-KTH/slumps

Suggestions

https://github.com/ASSERT-KTH/slumps.

assembles

replace 'assembles' by 'assemble'

Happy suggestion

Suggestions

assemble

graph

replace 'graph' by 'graphs.'

Happy suggestion

Multivariant call graphs.

Multivariant call graph

Suggestions

graphs.

the

replace 'the' by 'The'

Happy suggestion

As illustrated in Figure 3.3, MEWE takes the LLVM IR variants generated by CROW’s diversifier. It then merges LLVM IR variants into a Wasm multivariant. In the figure, we highlight the two components of MEWE, Multivariant Generation and the Mizer. In the Multivariant Generation process, MEWE gathers the LLVM IR variants created by CROW. The Mixer component, on the other hand, links the multivariant binary and creates a new entrypoint for the binary. Creating a new entrypoint is needed in case the output of CROW are variants of the original entrypoint, e.g. The main function. Concretely, it wraps the dispatcher for the entrypoint variants as a new function for the final Wasm binary and is declared as the application entrypoint. The random generator is needed to perform the execution-path randomization. For the random generator, we rely on WASI’s specification [41] for the random behavior of the dispatchers. However, its exact implementation is dependent on the host engine on which the binary is executed. Finally, using the same custom Wasm LLVM backend as CROW, we generate a standalone multivariant Wasm binary. Once generated, the multivariant Wasm binary can be deployed to any Wasm engine.

As illustrated in Figure 3.3, MEWE takes the LLVM IR variants generated by CROW’s diversifier. It then merges LLVM IR variants into a Wasm multivariant. In the figure, we highlight the two components of MEWE, Multivariant Generation and the Mizer. In the Multivariant Generation process, MEWE gathers the LLVM IR variants created by CROW. The Mixer component, on the other hand, links the multivariant binary and creates a new entrypoint for the binary. Creating a new entrypoint is needed in case the output of CROW are variants of the original entrypoint, e.g. the main function. Concretely, it wraps the dispatcher for the entrypoint variants as a new function for the final Wasm binary and is declared as the application entrypoint. The random generator is needed to perform the execution-path randomization. For the random generator, we rely on WASI’s specification [41] for the random behavior of the dispatchers. However, its exact implementation is dependent on the host engine on which the binary is executed. Finally, using the same custom Wasm LLVM backend as CROW, we generate a standalone multivariant Wasm binary. Once generated, the multivariant Wasm binary can be deployed to any Wasm engine.

Suggestions

replace 'at' by 'At'

Happy suggestion

This section describes MEWE [37], our second technical contribution. MEWE synthesizes diversified function variants by using CROW. It then provides execution-path randomization in a Multivariant Execution (MVE) [83]. Execution path randomization is a technique that randomizes the execution path of a program at runtime, i.e. At each invocation of a function, a different variant is executed. MEWE generates application-level multivariant binaries without changing the operating system or Wasm runtime. It creates an MVE by intermixing functions for which CROW generates variants, as illustrated by the green square in Figure 3.1. MEWE inlines function variants when appropriate, resulting in call stack diversification at runtime.

This section describes MEWE [37], our second technical contribution. MEWE synthesizes diversified function variants by using CROW. It then provides execution-path randomization in a Multivariant Execution (MVE) [83]. Execution path randomization is a technique that randomizes the execution path of a program at runtime, i.e. at each invocation of a function, a different variant is executed. MEWE generates application-level multivariant binaries without changing the operating system or Wasm runtime. It creates an MVE by intermixing functions for which CROW generates variants, as illustrated by the green square in Figure 3.1. MEWE inlines function variants when appropriate, resulting in call stack diversification at runtime.

Suggestions

insert '' by 'the'

Happy suggestion

Figure 3.3: Overview of the MEWE workflow. It takes as input an LLVM binary. It first generates a set of functionally equivalent variants for each function in the binary using CROW. Then, MEWE generates an LLVM multivariant binary composed of all the function variants. Then, the Mixer includes the behavior in charge of selecting a variant when a function is invoked. Finally, the MEWE mixer composes the LLVM multivariant binary with a random number generation library and tampers the original application entrypoint. The final process produces a Wasm multivariant binary ready to be deployed.

Figure 3.3: Overview of MEWE workflow. It takes as input an LLVM binary. It first generates a set of functionally equivalent variants for each function in the binary using CROW. Then, MEWE generates an LLVM multivariant binary composed of all the function variants. Then, the Mixer includes the behavior in charge of selecting a variant when a function is invoked. Finally, the MEWE mixer composes the LLVM multivariant binary with a random number generation library and tampers the original application entrypoint. The final process produces a Wasm multivariant binary ready to be deployed.

Suggestions

delete 'Le' by ''

Happy suggestion

Multivariant Generation LVM Multivariant binary re (T | random generator entrypoint tampering Multivariant Wasm Binary LLVM Multivariant function] N J binary I free function, functiony.

Multivariant Generation LVM Multivariant binary re (T | random generator entrypoint tampering Multivariant Wasm Binary LLVM Multivariant function] N J binary I freee function, functiony Le

Suggestions

functiony

replace 'functiony' by 'functiony.'

Happy suggestion

Multivariant Generation LVM Multivariant binary re (T | random generator entrypoint tampering Multivariant Wasm Binary LLVM Multivariant function] N J binary I free function, functiony.

Multivariant Generation LVM Multivariant binary re (T | random generator entrypoint tampering Multivariant Wasm Binary LLVM Multivariant function] N J binary I freee function, functiony Le

Suggestions

functiony.

freee

replace 'freee' by 'free'

Happy suggestion

Multivariant Generation LVM Multivariant binary re (T | random generator entrypoint tampering Multivariant Wasm Binary LLVM Multivariant function] N J binary I free function, functiony.

Multivariant Generation LVM Multivariant binary re (T | random generator entrypoint tampering Multivariant Wasm Binary LLVM Multivariant function] N J binary I freee function, functiony Le

Suggestions

free

]

Unpaired symbol: ‘[’ seems to be missing

Happy suggestion

Multivariant Generation LVM Multivariant binary re (T | random generator entrypoint tampering Multivariant Wasm Binary LLVM Multivariant function] N J binary I freee function, functiony Le

Suggestions

binary

replace 'binary' by 'binary.'

Happy suggestion

Exemplifying a Multivariant binary.

Exemplifying a Multivariant binary

Suggestions

binary.

whether

insert '' by 'of'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

insert '' by 'question'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

question

insert '' by 'the'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

insert '' by 'Then'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

Then

insert '' by 'Variant'

Happy suggestion

e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant e Variant

e Variant

Suggestions

Variant

insert '' by 'e'

Happy suggestion

e Variant

Suggestions

insert '' by 'Original'

Happy suggestion

Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original Original

Suggestions

Original

replace '©' by 'Original'

Happy suggestion

Suggestions

Original

3.7:

replace '3.7:' by '3.7.'

Happy suggestion

Listing 3.7. Dispatcher function embedded in the multivariant binary of the original function in the rightmost green node in Figure 3.4. The code is commented on for the sake of understanding.

Listing 3.7: Dispatcher function embedded in the multivariant binary of the original function in the rightmost green node in Figure 3.4. The code is commented on for the sake of understanding.

Suggestions

3.7.

delete '%4' by ''

Happy suggestion

define internal i32 @foo(i32 %0) entry: wi = call i32 @discriminate(i32 3) switch i32 41, label %end [ i32 0, label %case_43_ i32 1, label %case_44_] case_43_: 42 = call i32 @f00_43_(%0) ret i32 %2 case_44_: %3 = body of

define internal i32 @foo(i32 %0) { entry: wi = call i32 @discriminate(i32 3) switch i32 41, label %end [ i32 0, label %case_43_ i32 1, label %case_44_] case_43_: 42 = call i32 @f00_43_(%0) ret i32 %2 case_44_: %3 = ret i32 %3 end: %4 = call i32 @foo_original (%0) ret i32 %4

end:

delete 'end:' by ''

Happy suggestion

Suggestions

Happy suggestion

Suggestions

replace '=' by 'body'

Happy suggestion

Suggestions

body

replace '%3' by '='

replace 'call' by 'i32'

Happy suggestion

Suggestions

replace '=' by 'call'

Happy suggestion

Suggestions

call

label

replace 'label' by '%case_44_]'

Happy suggestion

Suggestions

%case_44_]

replace '1,' by 'label'

Happy suggestion

Suggestions

label

label

[

label

replace 'label' by '%end'

Happy suggestion

Suggestions

%end

41,

replace '41,' by 'label'

Happy suggestion

Suggestions

label

i32

replace 'i32' by '41,'

Happy suggestion

Suggestions

entry:

insert '' by 'N.'

Happy suggestion

binary IR transformed* IR ' ' | I ———— > a , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N. Wasm Wasm N

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

replace ''' by 'Wasm'

Happy suggestion

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

Suggestions

Wasm

replace 'I' by 'N.'

Happy suggestion

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

Wasm

generation

replace 'generation' by 'Wasm'

Happy suggestion

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

Suggestions

Wasm

(e-graph

replace '(e-graph' by 'Wasm'

Happy suggestion

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

Suggestions

Wasm

replace ':' by 'Wasm'

Happy suggestion

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

Suggestions

Wasm

e-graph

————

wasm-mutate

insert '' by '1'

Happy suggestion

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

insert '' by 'e-graph'

Happy suggestion

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

Suggestions

e-graph

————

transformed*

replace 'transformed*' by '''

Suggestions

binary

Don’t put a space on both sides of a quote symbol.

Happy suggestion

~ binary IR transformed* IR ' ' | I ———— > a} , I e-graph : (e-graph 1 generation *-------traversal 1 wasm-mutate | I I ' t I i. Wasm Wasm N

Suggestions

https://github.com/ASSERT-KTH/MEWE

replace 'https://github.com/ASSERT-KTH/MEWE' by 'https://github.com/ASSERT-KTH/MEWE.'

Happy suggestion

Contribution paper and artifact MEWE provides dynamic execution path randomization by packaging variants generated out of CROW. MEWE is fully presented in Cabrera-Arteaga et al. “Multi-Variant Execution at the Edge” Proceedings of Moving Target Defense, 2022, ACM https://dl.acm.o rg/doi/abs/10.1145/3560828. 3564007 MEWE is also available as an open-source tool at https://github.com/ASSERT-KTH/MEWE.

Suggestions

https://github.com/ASSERT-KTH/MEWE.

meta-rule,

replace 'meta-rule,' by 'meta-rule'

Happy suggestion

Rewriting rules inside the Peephole meta-rule operate over the data flow graph of instructions within a function body, representing the lowest level of rewriting. In WASM-MUTATE, we have implemented 125 rewriting rules specifically for this category, each one avoiding targeting instructions that might induce undefined behavior, e.g., function calls.

Rewriting rules inside the Peephole meta-rule, operate over the data flow graph of instructions within a function body, representing the lowest level of rewriting. In WASM-MUTATE, we have implemented 125 rewriting rules specifically for this category, each one avoiding targeting instructions that might induce undefined behavior, e.g., function calls.

Suggestions

meta-rule

enhancing

replace 'enhancing' by 'Enhancing'

Happy suggestion

WASM-MUTATE contains a comprehensive set of 135 rewriting rules. In this context, a rewriting rule is a triple (LHS, RHS, Cond) where LHS specifies the segment of binary targeted for replacement, RHS describes its functionally equivalent substitute, and Cond outlines the conditions that must be met for the replacement to take place, e.g. Enhancing type constraints. WASM-MUTATE groups these rewriting rules into meta-rules depending on their target inside a Wasm binary, ranging from high-level changes affecting binary section structure to low-level modifications within the code section. This section focuses on the biggest meta-rule implemented in WASM-MUTATE, the Peephole meta-rule?.

WASM-MUTATE contains a comprehensive set of 135 rewriting rules. In this context, a rewriting rule is a tuple (LHS, RHS, Cond) where LHS specifies the segment of binary targeted for replacement, RHS describes its functionally equivalent substitute, and Cond outlines the conditions that must be met for the replacement to take place, e.g. enhancing type constraints. WASM-MUTATE groups these rewriting rules into meta-rules depending on their target inside a Wasm binary, ranging from high-level changes affecting binary section structure to low-level modifications within the code section. This section focuses on the biggest meta-rule implemented in WASM-MUTATE, the Peephole meta-rule?.

Suggestions

Enhancing

tuple

replace 'tuple' by 'triple'

Happy suggestion

Suggestions

triple

Rules

replace 'Rules' by 'Rules.'

Happy suggestion

WebAssembly Rewriting Rules.

WebAssembly Rewriting Rules

Suggestions

Rules.

I multiple

A verb or adverb may be missing or misspelled.

Happy suggestion

Definition 2 (Stacked transformation) Given an original input WebAssembly binary I and a diversifier D, stacked transformations are defined as the application of D over the binary I multiple times, t.e., D(D(D(...(1)))). Notice that, the number of stacked transformations is the number of times the diversifier D is applied.

Suggestions

transformation

replace 'transformation' by 'transformation.'

Figure 3.5 illustrates the workflow of WASM-MUTATE, which initiates with a WebAssembly binary as its input. The first step involves parsing this binary to create suitable abstractions, e.g. An intermediate representation. Subsequently, WASM-MUTATE uses predefined rewriting rules to construct an e-graph for the initial program, encapsulating all potential equivalent codes derived from the rewriting rules. The assurance of functional equivalence is rooted in the inherent properties of the individual rewrite rules employed. Then, pieces of the original program are randomly substituted by the result of random e-graph traversals, resulting in a variant that maintains functional equivalence to the original binary.

Figure 3.5 illustrates the workflow of WASM-MUTATE, which initiates with a WebAssembly binary as its input. The first step involves parsing this binary to create suitable abstractions, e.g. an intermediate representation. Subsequently, WASM-MUTATE uses predefined rewriting rules to construct an e-graph for the initial program, encapsulating all potential equivalent codes derived from the rewriting rules. The assurance of functional equivalence is rooted in the inherent properties of the individual rewrite rules employed. Then, pieces of the original program are randomly substituted by the result of random e-graph traversals, resulting in a variant that maintains functional equivalence to the original binary.

Suggestions

Concretly,

omitting

delete 'omitting' by ''

Happy suggestion

Willsey et al. Highlight the potential for high flexibility in extracting code fragments from e-graphs, a process that can be recursively orchestrated through a cost function applied to e-nodes and their respective operands. This methodology ensures the functional equivalence of the derived code [143]. For instance, e-graphs address the challenge of generating optimal code from multiple optimization rules, regardless of their application sequence [146]. To extract the “optimal” code from an e-graph, one might commence the extraction at a specific e-node, subsequently selecting the AST with the minimal size from the available options within the corresponding e-class’s operands. Omitting the cost function from the extraction strategy leads us to a significant property: any path navigated through the e-graph yields a functionally equivalent code variant.

Willsey et al. highlight the potential for high flexibility in extracting code fragments from e-graphs, a process that can be recursively orchestrated through a cost function applied to e-nodes and their respective operands. This methodology ensures the functional equivalence of the derived code [143]. For instance, e-graphs address the challenge of generating the optimal code from multiple optimization rules, regardless of their application sequence [146]. To extract the “optimal” code from an e-graph, one might commence the extraction at a specific e-node, subsequently selecting the AST with the minimal size from the available options within the corresponding e-class’s operands. In omitting the cost function from the extraction strategy leads us to a significant property: any path navigated through the e-graph yields a functionally equivalent code variant.

Suggestions

delete 'In' by ''

size

replace 'size' by 'from'

Happy suggestion

Suggestions

from

minimal

replace 'minimal' by 'size'

Happy suggestion

Suggestions

size

the

replace 'the' by 'minimal'

Happy suggestion

Suggestions

minimal

with

replace 'with' by 'the'

Happy suggestion

Suggestions

AST

replace 'AST' by 'with'

Happy suggestion

Suggestions

with

selecting

e-node,

replace 'e-node,' by 'subsequently'

Happy suggestion

Suggestions

subsequently

extraction

commence

replace 'commence' by 'the'

Suggestions

replace 'an' by 'e-graph,'

Happy suggestion

Suggestions

e-graph,

from

replace 'from' by 'an'

Suggestions

replace 'To' by 'extract'

Happy suggestion

Suggestions

extract

[146].

replace '[146].' by 'To'

Suggestions

application

replace 'of' by 'their'

Happy suggestion

Suggestions

their

regardless

replace 'regardless' by 'of'

E-Graph traversal.

E-Graph traversal

Suggestions

traversal.

insert '' by 'of'

Happy suggestion

Let us illustrate how WASM-MUTATE generates variant programs by using the algorithm enunciated previously. Here, we use Algorithm 1 with a maximum depth of 1. In Listing 3.8, a hypothetical original Wasm binary is illustrated. In this context, a potential user has set two pivotal rewriting rules: (x, container (x nop),) and (x, x i32.add 0, x instance of i32). The former rule grants the ability to append a nop instruction to any subexpression, a well-known low-level diversification strategy [82]. The latter rule adds zero to any numeric value.

Let us illustrate how WASM-MUTATE generates variant programs by using the algorithm enunciated previously. Here, we use Algorithm 1 with a maximum depth of 1. In Listing 3.8 a hypothetical original Wasm binary is illustrated. In this context, a potential user has set two pivotal rewriting rules: (x, container (x nop),) and (x, x i32.add 0, x instanceof i32). The former rule grants the ability to append a nop instruction to any subexpression, a well-known low-level diversification strategy [82]. The latter rule adds zero to any numeric value.

Suggestions

instanceof

replace 'instanceof' by 'instance'

Happy suggestion

Suggestions

instance

Algorithm 1 e-graph traversal algorithm. 1: procedure TRAVERSE(egraph, eclass, depth) 2: if depth = 0 then 3: return smallest_tree_from(egraph, eclass) 4: else 5: nodes + egraphleclass] 6: node <— random_choice(nodes) expr < (node, operands = |]) 8 for each child € node.children do 9: subexpr ~ TRAVERSE(egraph, child, depth — 1) 10: expr.operands < expr.operands U {subexpr} 11: return expr

Suggestions

child

replace 'child' by '€'

Happy suggestion

Algorithm 1 e-graph traversal algorithm. 1: procedure TRAVERSE(egraph, eclass, depth) 2: if depth = 0 then 3: return smallest_tree_from(egraph, eclass) 4: else 5: nodes + egraphleclass] 6: node <— random_choice(nodes) expr < (node, operands = |]) 8 for each child € node.children do 9: subexpr ~ TRAVERSE(egraph, child, depth — 1) 10: expr.operands < expr.operands U {subexpr} 11: return expr

Suggestions

each

replace 'each' by 'child'

Happy suggestion

Algorithm 1 e-graph traversal algorithm. 1: procedure TRAVERSE(egraph, eclass, depth) 2: if depth = 0 then 3: return smallest_tree_from(egraph, eclass) 4: else 5: nodes + egraphleclass] 6: node <— random_choice(nodes) expr < (node, operands = |]) 8 for each child € node.children do 9: subexpr ~ TRAVERSE(egraph, child, depth — 1) 10: expr.operands < expr.operands U {subexpr} 11: return expr

Suggestions

child

<—

replace '<—' by '—'

Happy suggestion

Algorithm 1 e-graph traversal algorithm. 1: procedure TRAVERSE(egraph, eclass, depth) 2: if depth = 0 then 3: return smallest_tree_from(egraph, eclass) 4: else 5: nodes + egraphleclass] 6: node <— random_choice(nodes) expr < (node, operands = |]) 8 for each child € node.children do 9: subexpr ~ TRAVERSE(egraph, child, depth — 1) 10: expr.operands < expr.operands U {subexpr} 11: return expr

Suggestions

]

Unpaired symbol: ‘[’ seems to be missing

Happy suggestion

Algorithm 1 e-graph traversal algorithm. 1: procedure TRAVERSE(egraph, eclass, depth) 2: if depth = 0 then 3: return smallest_tree_from(egraph, eclass) 4: else 5: nodes + egraphleclass] 6: node <— random_choice(nodes) expr < (node, operands = |]) 8 for each child € node.children do 9: subexpr ~ TRAVERSE(egraph, child, depth — 1) 10: expr.operands < expr.operands U {subexpr} 11: return expr

Suggestions

node

Possible agreement error. The noun ‘node’ seems to be countable.

Happy suggestion

The algorithm initiates at the e-class with the instruction i64.const 1, as seen in Listing 3.8. At (2), it randomly selects an equivalent node within the e-class, in this instance taking the i64.add node, resulting: expr = i64.add 1 r. As the traversal advances, it follows on the left operand of the previously chosen node, settling on the i64.const 0 node within the same e-class (3). Then, the right operand of the i64.add node is selected, selecting the container(4) operator yielding: expr = i64.or (i64.const 0 container (r nop)). The algorithm chooses the right operand of the container (5), which correlates to the initial instruction e-node highlighted in (6), culminating in the final expression: expr = i64.or (i64.const 0 container(i64.const 1 nop)) i64.const 1. As we proceed to the encoding phases, the container operator is ignored as a real Wasm instruction, finally resulting in the program in Listing 3.9.

Suggestions

nodes

i64)))

replace 'i64)))' by 'i64))'

Happy suggestion

(module (type (;0;) (func (param i32 £32) (result i64)) (func (;0;) (type 0) (param i32 £32) (result i64) i64.const 1)) Listing 3.8: Wasm function.

(module (type (;0;) (func (param i32 £32) (result i64))) (func (;0;) (type 0) (param i32 £32) (result i64) i64.const 1)) Listing 3.8: Wasm function.

Suggestions

i64))

(

Unpaired symbol: ‘)’ seems to be missing

Happy suggestion

(module (type (;0;) (func (param i32 £32) (result i64))) (func (;0;) (type 0) (param i32 £32) (result i64) i64.const 1)) Listing 3.8: Wasm function.

Suggestions

3.6.

replace '3.6.' by '3.6'

Happy suggestion

(module (type (;0;) (func (param i32 £32) (result i64)) (func (;0;) (type 0) (param i32 £32) (result i64) (i64.add (i64.const 0 1i64.const 1 nop))) Listing 3.9: Random peephole mutation using e-graph traversal for Listing 3.8 over e-graph Figure 3.6 The textual format is folded for better understanding.

(module (type (;0;) (func (param i32 £32) (result i64))) (func (;0;) (type 0) (param i32 £32) (result i64) (i64.add (i64.const 0 1i64.const 1 nop))) Listing 3.9: Random peephole mutation using e-graph traversal for Listing 3.8 over e-graph Figure 3.6. The textual format is folded for better understanding.

Suggestions

i64)))

replace 'i64)))' by 'i64))'

Happy suggestion

Suggestions

i64))

Algorithm

replace 'Algorithm' by 'algorithm'

Happy suggestion

Notice that, within the e-graph showcased in Figure 3.6, the container node maintains equivalence across all e-classes. Consequently, increasing the depth parameter in algorithm 1 would potentially escalate the number of viable variants infinitely.

Notice that, within the e-graph showcased in Figure 3.6, the container node maintains equivalence across all e-classes. Consequently, increasing the depth parameter in Algorithm 1 would potentially escalate the number of viable variants infinitely.

Suggestions

algorithm

need

there

whether

insert '' by 'of'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

insert '' by 'question'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

question

insert '' by 'the'

Random e-node selection

Suggestions

selection.

selection

delete 'selection' by ''

Happy suggestion

oe XS Left Operand eyclass operand S. fay a i64.const 0 | container e-class) ()) container i64.add " Right Left Operand Operand i Operand nop container Left Operand Right Operand Left Operand Operator-Operand relation Random e-node selection.

Suggestions

e-node

delete 'e-node' by ''

Suggestions

container

replace 'i' by 'nop'

Happy suggestion

Suggestions

insert '' by 'i'

Happy suggestion

Suggestions

insert '' by 'Operand'

Happy suggestion

Suggestions

Operand

“https://bytecodealliance.org/

replace '“https://bytecodealliance.org/' by '“https://bytecodealliance.org/”'

Happy suggestion

Contribution paper and artifact WASM-MUTATE uses rewriting rules and random traversals over e-graphs to provide a binary-based solution for WebAssembly diversification. WASM-MUTATE is fully presented in Cabrera-Arteaga et al. “WASM-MUTATE: Fast and Effective Binary Diversification for WebAssembly” Computers & Security, 2024. https://www.sciencedirect.com/science/article/pii/S0167404824000 324. WASM-MUTATE is available at https://github.com/bytecodealliance/wasm-t ools/tree/main/crates/wasm-mutate as a contribution to the Bytecode Alliance organization “. The Bytecode Alliance is dedicated to creating secure new software foundations, building on standards such as WebAssembly and WASI. “https://bytecodealliance.org/”

Suggestions

“https://bytecodealliance.org/”

Variants

An apostrophe may be missing.

Happy suggestion

On the other hand, CROW and MEWE, by using enumerative synthesis, ensure that the generated variants are more preserved than the variants created by WASM-MUTATE. In other words, the transformations generated out of CROW and MEWE are virtually irreversible by JIT compilers, such as V8 and wasmtime. This phenomenon is highlighted in the Variants strength column of Table 3.1, where we show that CROW and MEWE generate variants with 96% of preservation against 75% of WASM-MUTATE. High preservation is especially important where the preservation of the diversification is crucial, e.g., to hinder reverse engineering.

Suggestions

Variants'
Variant's

with

replace 'with' by 'With'

Happy suggestion

Tool Input Core Variants | Target Variants | Security applications in lh Strength CROW Source code or | Enumerative > 1k Code 96% Hinders static analysis and LLVM Ir synthesis section reverse engineering. With functional equivalence proved through SMT solvers MEWE Source code or | CROW, > 1k Code and | 96% Hinders static and LL VM Ir Multivariant Function dynamic analysis, reverse execution sections engineering and web timing-based attacks. WASM-Wasm binary | hand-made > 10k All Web-| 76% Hinders signature-MUTATE rewriting rules, Assembly based identification, and e-sections cache timing side-channel graph random traversals attacks.

Tool Input Core Variants | Target Variants | Security applications in lh Strength CROW Source code or | Enumerative > 1k Code 96% Hinders static analysis and LLVM Ir synthesis section reverse engineering. with functional equivalence proved through SMT solvers MEWE Source code or | CROW, > 1k Code and | 96% Hinders static and LL VM Ir Multivariant Function dynamic analysis, reverse execution sections engineering and web timing-based attacks. WASM-Wasm binary | hand-made > 10k All Web-| 76% Hinders signature-MUTATE rewriting rules, Assembly based identification, and e-sections cache timing side-channel graph random traversals attacks.

Suggestions

With

applications

replace 'applications' by 'applications.'

Happy suggestion

Security applications.

Security applications

Suggestions

applications.

and,

replace 'and,' by 'and'

Happy suggestion

WRN cr neha CROW, MEWE and WASM-MUTATE generate WebAssembly variants that can be used to enhance security. Overall, they generate variants that are suitable for hardening static and dynamic analysis, side-channel attacks, and thwarting signature-based identification.

Suggestions

increase

replace 'increase' by 'increasing'

Happy suggestion

Last but not least, our technical contributions enhance security against web timing-based attacks [147, 148] by creating variants that exhibit a wide range of execution times, including faster variants compared to the original program. This strategy is especially prominent in MEWE’s approach, which develops multivariants functioning on randomizing execution paths, thereby thwarting attempts at timing-based inference attacks [148]. Adding another layer of benefit from MEWE, the integration of diverse variants into multivariants can potentially disrupt dynamic reverse engineering tools such as symbolic executors [96]. Concretely, different control flows through a random discriminator, exponentially increasing the number of possible execution paths, making multivariant binaries virtually unexplorable.

Last but not least, our technical contributions enhance security against web timing-based attacks [147, 148] by creating variants that exhibit a wide range of execution times, including faster variants compared to the original program. This strategy is especially prominent in MEWE’s approach, which develops multivariants functioning on randomizing execution paths, thereby thwarting attempts at timing-based inference attacks [148]. Adding another layer of benefit from MEWE, the integration of diverse variants into multivariants can potentially disrupt dynamic reverse engineering tools such as symbolic executors [96]. Concretely, different control flows through a random discriminator, exponentially increase the number of possible execution paths, making multivariant binaries virtually unexplorable.

Suggestions

increasing

Knuth

replace 'Knuth' by 'Knuth.'

Happy suggestion

— Donald Knuth.

— Donald Knuth

Suggestions

Knuth.

FOR

delete 'FOR' by ''

Happy suggestion

ASSESSING SOFTWARE DIVERSIFICATION FOR ASSESSING SOFTWARE DIVERSIFICATION FOR ASSESSMENT OF SOFTWARE DIVERSIFICATION FOR ASSESSMENT OF SOFTWARE DIVERSIFICATION FOR ASSESSMENT OF SOFTWARE DIVERSIFICATION FOR ASSESSMENT OF SOFTWARE DIVERSIFICATION FOR ASSESSMENT OF SOFTWARE DIVERSIFICATION FOR ASSESSMENT OF SOFTWARE DI

ASSESSING SOFTWARE DIVERSIFICATION FOR

Suggestions

DIVERSIFICATION

ASSESSMENT

insert '' by 'FOR'

Happy suggestion

ASSESSING SOFTWARE DIVERSIFICATION FOR

ASSESSING

insert '' by 'hardware.'

Happy suggestion

Offensive and defensive purposes. We discuss two selected use cases that demonstrate the practical applications of our contributions. Additionally, we discuss the challenges and benefits arising from the application of Software Diversification to WebAssembly. In this chapter, we illustrate the application of Software Diversification for both software and hardware.

offensive and defensive purposes. We discuss two selected use cases that demonstrate the practical applications of our contributions. Additionally, we discuss the challenges and benefits arising from the application of Software Diversification to WebAssembly. I N this chapter, we illustrate the application of Software Diversification for both

Suggestions

hardware.

insert '' by 'and'

Software

application

replace 'application' by 'of'

Happy suggestion

Suggestions

the

replace 'the' by 'application'

Happy suggestion

Suggestions

application

illustrate

replace 'illustrate' by 'the'

Happy suggestion

Suggestions

replace 'we' by 'illustrate'

Happy suggestion

Suggestions

illustrate

Offensive

offensive

This sentence does not start with an uppercase letter.

Happy suggestion

Suggestions

Offensive

whether

insert '' by 'of'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

insert '' by 'question'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

question

insert '' by 'the'

Suggestions

server.

pool

replace 'pool' by 'or'

Happy suggestion

User browser Remote mining pool or server.

Suggestions

mining

replace 'mining' by 'pool'

Happy suggestion

User browser Remote mining pool or server.

Suggestions

pool

Remote

replace 'Remote' by 'mining'

Happy suggestion

User browser Remote mining pool or server.

Suggestions

mining

Happy suggestion

User browser Remote mining pool or server.

Suggestions

Remote

into

replace 'into' by 'in'

Happy suggestion

The primary malicious use of WebAssembly in browsers is cryptojacking [66]. This is due to the essence of cryptojacking, the faster the mining, the better. Let us illustrate how a malicious WebAssembly binary is involved in browser cryptojacking. Figure 4.1 illustrates a browser attack scenario: a practical WebAssembly cryptojacking attack consists of three components: a WebAssembly binary, a JavaScript wrapper, and a backend cryptominer pool. The WebAssembly binary is responsible for executing the hash calculations, which consume significant computational resources. The JavaScript wrapper facilitates the communication between the WebAssembly binary and the cryptominer pool.

The primary malicious use of WebAssembly in browsers is cryptojacking [66]. This is due to the essence of cryptojacking, the faster the mining, the better. Let us illustrate how a malicious WebAssembly binary is involved into browser cryptojacking. Figure 4.1 illustrates a browser attack scenario: a practical WebAssembly cryptojacking attack consists of three components: a WebAssembly binary, a JavaScript wrapper, and a backend cryptominer pool. The WebAssembly binary is responsible for executing the hash calculations, which consume significant computational resources. The JavaScript wrapper facilitates the communication between the WebAssembly binary and the cryptominer pool.

Suggestions

evasion

replace 'evasion' by 'evasion.'

Happy suggestion

Offensive Diversification: Malware evasion.

Offensive Diversification: Malware evasion

Suggestions

evasion.

evasion

replace 'evasion' by 'evasion.'

Happy suggestion

Cryptojacking defense evasion.

Cryptojacking defense evasion

Suggestions

evasion.

insert '' by 'They'

Happy suggestion

Both antivirus software and browsers have implemented measures to detect cryptojacking. For instance, Firefox employs deny lists to detect cryptomining activities [149]. The academic community has also contributed to the body of work on detecting or preventing WebAssembly-based cryptojacking, as outlined in Section 2.1.5. However, malicious actors can employ evasion techniques to circumvent these detection mechanisms. Bhansali et al. They are among the first who have investigated how WebAssembly cryptojacking could potentially evade detection [67], highlighting the critical importance of this use case. The case illustrated in the subsequent sections uses Offensive Software Diversification for evading malware detection in WebAssembly.

Both antivirus software and browsers have implemented measures to detect cryptojacking. For instance, Firefox employs deny lists to detect cryptomining activities [149]. The academic community has also contributed to the body of work on detecting or preventing WebAssembly-based cryptojacking, as outlined in Section 2.1.5. However, malicious actors can employ evasion techniques to circumvent these detection mechanisms. Bhansali et al. are among the first who have investigated how WebAssembly cryptojacking could potentially evade detection [67], highlighting the critical importance of this use case. The case illustrated in the subsequent sections uses Offensive Software Diversification for evading malware detection in WebAssembly.

Suggestions

They

)

Unpaired symbol: ‘(’ seems to be missing

Happy suggestion

@ User browser ‘QO Malware @ Remote detector QY) mining pool or server Malware) evasion technique BI)

Suggestions

insert '' by 'Method'

Happy suggestion

Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Methodology Method

Methodology

Suggestions

Method

insert '' by 'Methodology'

Happy suggestion

Methodology

Suggestions

Methodology

)

Unpaired symbol: ‘(’ seems to be missing

Happy suggestion

We use the wasmbench dataset [45] to establish a ground truth. After running the wasmbench dataset through VirusTotal and MINOS, we identify 33 binaries that are: 1) flagged as malicious by at least one VirusTotal vendor and, 2) are also detected by MINOS. Then, to simulate the evasion scenario in Figure 4.2, we use WASM-MUTATE to generate WebAssembly binary variants to evade malware detection ((4) in Figure 4.2). We use WASM-MUTATE in two configurations: feedback-guided and stochastic diversification.

Suggestions

identified

Results

replace 'Results' by 'Results:'

Happy suggestion

Results:

Results

Suggestions

Results:

solely

delete 'solely' by ''

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section only includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

section

delete 'section' by ''

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

lower,

replace 'lower,' by 'better.'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

better.

best,

delete 'best,' by ''

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

setups

replace 'setups' by 'lower,'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

lower,

setups

stochastic

delete 'stochastic' by ''

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

the

replace 'the' by 'feedback-guided'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

feedback-guided

which

replace 'which' by 'or'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

bold

sample.

replace 'sample.' by 'in'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

each

replace 'each' by 'highlight'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

highlight

for

replace 'for' by 'We'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

(Mean

number

replace 'number' by 'required'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

required

average

replace 'average' by 'transformations'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

transformations

the

replace 'the' by 'of'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

#evaded),

successfully

replace 'successfully' by '(Max.'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

(Max.

replace 'of' by 'detectors'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

detectors

number

replace 'number' by 'evaded'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

evaded

maximum

replace 'maximum' by 'successfully'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

successfully

(#D),

replace '(#D),' by 'number'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

number

(#D),

original

replace 'original' by 'malware'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

malware

the

replace 'the' by 'as'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

vendors

the

replace 'the' by 'VirusTotal'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

VirusTotal

indicate

replace 'indicate' by 'of'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

columns

replace 'columns' by 'number'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

number

columns

diversification.

replace 'diversification.' by 'the'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

feedback-guided

configurations

replace 'configurations' by 'and'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

diversification

results

based

insert '' by 'results'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

results

insert '' by 'the'

Happy suggestion

In Table 4.1, we present a comprehensive summary of the evasion experiments presented in [39], focusing on two oracles: VirusTotal and MINOS [28]. The table is organized into two main categories to separate the results for each malware oracle. For VirusTotal, we further subdivide the results based on the two diversification configurations we employ: stochastic and feedback-guided diversification. In these subsections, the columns indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which the stochastic diversification or feedback-guided diversification setups best, the lower, the better. The MINOS section solely includes a column that specifies the number of transformations needed for complete evasion. The table has 33 + 1 rows, each representing a unique WebAssembly malware study subject. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

delete '38' by ''

Happy suggestion

VirusTotal Minos [28] Hash #D Stochastic div. Feedback-guided div. Max. evaded Mean trans. | Max. evaded Mean trans. | Mean trans. 47d29959 31 26 N/A 19 N/A 100 9d30e7f0 30 24 N/A 17 N/A 419 8ebf4e44 26 21 N/A 13. N/A 92 c11d82d 20 20 355 20 446 115 0d996462 19 19 401 19 697 24 a32a6f4b 18 18 635 18 625 1 fbddlefa 18 18 310 18 726 1 d2141ff2 9 9 461 9 781 81 aafff587 6 6 484 6 331 1 046dc081 6 6 404 6 159 33 643116fF 72 il 65debcbe 2 2 131 2 33 38 59955b4c 2 2 130 2 33 38 89a3645c 2 2 431 2 107 108 a74a7cb8 2 2 124 2 33 38 119c53eb 2 2 104 2 18 it 089dd312 2 2 153 2 123 68 clbe4071 2 2 130 2 33 38 dceaf65b 2 2 140 2 132 66 6b

VirusTotal MINOS [28] Hash #D Stochastic div. Feedback-guided div. Max. evaded Mean trans. | Max. evaded Mean trans. | Mean trans. 47d29959 31 26 N/A 19 N/A 100 9d30e7f0 30 24 N/A 17 N/A 419 8ebf4e44 26 21 N/A 13. N/A 92 c11d82d 20 20 355 20 446 115 0d996462 19 19 401 19 697 24 a32a6f4b 18 18 635 18 625 1 fbddlefa 18 18 310 18 726 1 d2141ff2 9 9 461 9 781 81 aafff587 6 6 484 6 331 1 046dc081 6 6 404 6 159 33 643116fF 6 6 144 6 436 47 15b86a25 4 4 253 4 1381 lh 006b2fb6 4 4 282 4 380 HI 942be4f7 4 4 200 4 200 29 7c36f462 4 4 236 4 221 85 fb15929f 4 4 297 4 475 il 24aael3a 4 4 252 4 401 980 000415b2 3 3 302 3 34 960 4cbdbbb1 3 3 295 3. 72 il 65debcbe 2 2 131 2 33 38 59955b4c 2 2 130 2 33 38 89a3645c 2 2 431 2 107 108 a74a7cb8 2 2 124 2 33 38 119c53eb 2 2 104 2 18 it 089dd312 2 2 153 2 123 68 clbe4071 2 2 130 2 33 38 dceaf65b 2 2 140 2 132 66 6b8c7899 2 2 143 2 33 38 a27b45ef 2 2 145 2 33 33 68ca7c0e 2 2 137 2 33 38 f0b24409 2 2 127 2 11 33 5bc53343 2 2 118 2 33 33 e09c32c5 1 1 120 1 488 15 Median 218 131 38

Suggestions

131

delete '131' by ''

Happy suggestion

Suggestions

218

delete '218' by ''

Happy suggestion

Happy suggestion

Suggestions

Happy suggestion

Suggestions

delete '72' by ''

Happy suggestion

Suggestions

delete '3.' by ''

Happy suggestion

Suggestions

295

delete '295' by ''

Happy suggestion

Suggestions

Happy suggestion

Suggestions

302

replace '302' by '6b'

Happy suggestion

Suggestions

replace '3' by '66'

Happy suggestion

Suggestions

Suggestions

24aael3a

replace '24aael3a' by '2'

Happy suggestion

Suggestions

Happy suggestion

Suggestions

fb15929f

replace 'fb15929f' by '2'

Happy suggestion

Suggestions

Happy suggestion

Suggestions

7c36f462

replace '7c36f462' by '2'

Happy suggestion

Suggestions

942be4f7

replace '942be4f7' by '2'

Happy suggestion

Suggestions

Happy suggestion

Suggestions

006b2fb6

replace '006b2fb6' by '2'

Happy suggestion

Suggestions

15b86a25

replace '15b86a25' by '2'

Happy suggestion

Suggestions

replace '47' by '130'

Happy suggestion

Suggestions

436

replace '436' by '2'

Happy suggestion

Suggestions

Happy suggestion

Suggestions

643116fF

replace '643116fF' by '2'

Happy suggestion

Suggestions

Suggestions

310

replace '310' by '461'

Happy suggestion

Suggestions

fbddlefa

replace 'fbddlefa' by 'd2141ff2'

Happy suggestion

Suggestions

d2141ff2

115

replace '115' by '24'

Happy suggestion

Suggestions

446

replace '446' by '697'

Happy suggestion

Suggestions

Happy suggestion

Suggestions

replace '26' by '20'

Happy suggestion

Suggestions

8ebf4e44

replace '8ebf4e44' by 'c11d82d'

Happy suggestion

Suggestions

c11d82d

419

replace '419' by '92'

Happy suggestion

Suggestions

replace '17' by '13.'

Happy suggestion

Suggestions

replace '24' by '21'

Happy suggestion

Suggestions

replace '30' by '26'

Happy suggestion

Suggestions

9d30e7f0

replace '9d30e7f0' by '8ebf4e44'

Happy suggestion

Suggestions

8ebf4e44

100

replace '100' by '419'

Happy suggestion

Suggestions

replace '19' by '17'

Happy suggestion

Suggestions

delete '26' by ''

Happy suggestion

Suggestions

Mean

replace 'Mean' by '100'

Happy suggestion

Suggestions

Happy suggestion

Suggestions

47d29959

insert '' by '|'

Happy suggestion

Suggestions

insert '' by 'trans.'

Happy suggestion

Suggestions

trans.

insert '' by 'Mean'

Happy suggestion

Suggestions

Mean

div.

replace 'div.' by 'evaded'

Happy suggestion

Suggestions

evaded

div.

MINOS

replace 'MINOS' by 'Minos'

Happy suggestion

Suggestions

Minos

MINOS.

replace 'MINOS.' by 'Minos.'

Happy suggestion

Table 4.1: The table has two main categories for each malware oracle, corresponding to the two oracles we use: VirusTotal and Minos. For VirusTotal, divide the results based on the two diversification configurations: stochastic and feedback-guided diversification. We provide columns that indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which diversification setups are best, where the lower, the better. The MINOS section includes a column that specifies the number of transformations needed for complete evasion. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Table 4.1: The table has two main categories for each malware oracle, corresponding to the two oracles we use: VirusTotal and MINOS. For VirusTotal, divide the results based on the two diversification configurations: stochastic and feedback-guided diversification. We provide columns that indicate the number of VirusTotal vendors that flag the original binary as malware (#D), the maximum number of successfully evaded detectors (Max. #evaded), and the average number of transformations required (Mean #trans.) for each sample. We highlight in bold text the values for which diversification setups are best, where the lower, the better. The MINOS section includes a column that specifies the number of transformations needed for complete evasion. The final row offers the median number of transformations required for evasion across our evaluated setups and oracles.

Suggestions

Minos.

the

delete 'the' by ''

Happy suggestion

Feedback-guided diversification to evade VirusTotal: stochastic diversification does not guide the diversification based on the number of evaded detectors, it is purely random and has some drawbacks. For example, some transformations might suppress other transformations previously applied. We have observed that, by carefully selecting the order and type of transformations applied, it is possible to evade detection systems in fewer iterations. This can be appreciated in the results of the feedback-guided diversification part of Table 4.1. The feedback-guided diversification setup successfully generates variants that totally evade detection for 30 out of 33 binaries, it is thus as good as the stochastic setup. Remarkably, for 21 binaries out of 30, feedback-guided needs only 40% of the calls the stochastic diversification setup needs, demonstrating larger efficiency. Moreover, the lower number of transformations needed to evade detection, compared to the stochastic diversification setup, highlights the efficacy of the feedback-guided diversification setup in studying effective transformations. Consequently, malware detection system developers can leverage feedback-guided diversification to enhance their systems, focusing on identifying specific transformations.

Feedback-guided diversification to evade VirusTotal: stochastic diversification does not guide the diversification based on the number of evaded detectors, it is purely random and has some drawbacks. For example, some transformations might suppress other transformations previously applied. We have observed that, by carefully selecting the order and type of transformations applied, it is possible to evade detection systems in fewer iterations. This can be appreciated in the results of the feedback-guided diversification part of Table 4.1. The feedback-guided diversification setup successfully generates variants that totally evade the detection for 30 out of 33 binaries, it is thus as good as the stochastic setup. Remarkably, for 21 binaries out of 30, feedback-guided needs only 40% of the calls the stochastic diversification setup needs, demonstrating larger efficiency. Moreover, the lower number of transformations needed to evade detection, compared to the stochastic diversification setup, highlights the efficacy of the feedback-guided diversification setup in studying effective transformations. Consequently, malware detection system developers can leverage feedback-guided diversification to enhance their systems, focusing on identifying specific transformations.

Suggestions

2.1.5

delete '2.1.5' by ''

Happy suggestion

Relying exclusively on VirusTotal for detection could pose issues, particularly given the existence of specialized solutions for WebAssembly, which differ from the general-purpose vendors within VirusTotal. In Section 2.1.5, we highlight several examples of such solutions. Yet, for its simplicity, we extend this experiment by using MINOS [28], an antivirus specifically designed for WebAssembly. The results of evading MINOS can be seen in the final column of Table 4.1. The bottom row of Table 4.1 highlights that fewer iterations are required to evade MINOS than VirusTotal through WebAssembly diversification, indicating a greater ease in eluding MINOS. The stochastic diversification setup requires a median iteration count of 218 to evade VirusTotal. In contrast, the feedback-guided diversification setup necessitates only 131 iterations. Remarkably, a mere 38 iterations are needed for MINOS. WASM-MUTATE evaded detection for 8 out of 33 binaries in a single iteration. This result implies the susceptibility of the MINOS model to binary diversification.

Stochastic diversification to evade MINOS: Relying exclusively on VirusTotal for detection could pose issues, particularly given the existence of specialized solutions for WebAssembly, which differ from the general-purpose vendors within VirusTotal. In Section 2.1.5 we highlight several examples of such solutions. Yet, for its simplicity, we extend this experiment by using MINOS [28], an antivirus specifically designed for WebAssembly. The results of evading MINOS can be seen in the final column of Table 4.1. The bottom row of Table 4.1 highlights that fewer iterations are required to evade MINOS than VirusTotal through WebAssembly diversification, indicating a greater ease in eluding MINOS. The stochastic diversification setup requires a median iteration count of 218 to evade VirusTotal. In contrast, the feedback-guided diversification setup necessitates only 131 iterations. Remarkably, a mere 38 iterations are needed for MINOS. WASM-MUTATE evaded detection for 8 out of 33 binaries in a single iteration. This result implies the susceptibility of the MINOS model to binary diversification.

Suggestions

Section

delete 'Section' by ''

Happy suggestion

Suggestions

general-purpose

replace 'general-purpose' by 'Section'

Happy suggestion

Suggestions

Section

the

replace 'the' by 'In'

Suggestions

solutions

replace 'solutions' by 'from'

Happy suggestion

Suggestions

from

specialized

replace 'specialized' by 'differ'

Happy suggestion

Suggestions

differ

replace 'of' by 'which'

Happy suggestion

Suggestions

which

existence

replace 'existence' by 'WebAssembly,'

Happy suggestion

Suggestions

WebAssembly,

the

replace 'the' by 'for'

Suggestions

pose

replace 'pose' by 'existence'

Happy suggestion

Suggestions

existence

could

replace 'could' by 'the'

Happy suggestion

Suggestions

detection

replace 'detection' by 'given'

Happy suggestion

Suggestions

given

for

replace 'for' by 'particularly'

Happy suggestion

Suggestions

particularly

replace 'on' by 'pose'

Happy suggestion

Suggestions

pose

exclusively

replace 'exclusively' by 'could'

Happy suggestion

Suggestions

could

Relying

replace 'Relying' by 'detection'

Happy suggestion

Suggestions

detection

exclusively

Stochastic

replace 'Stochastic' by 'Relying'

Happy suggestion

Suggestions

Relying

correctness:

delete 'correctness:' by ''

Happy suggestion

To evaluate the correctness of the malware variants created with WASM-MUTATE, we focused on six binaries that we could build and execute end-to-end, as these had all three components outlined in Figure 4.1. We select only six binaries because the process of building and executing the binaries involves three components: the WebAssembly binary, its JavaScript complement, and the miner pool. These components were not found for the remaining 24 evaded binaries in the study subjects. For the six binaries, we then replace the original WebAssembly code with variants generated using VirusTotal as the malware oracle and WASM-MUTATE for both controlled and stochastic diversification configurations. We then execute both the original and the generated variants. We assess the correctness of the variants by examining the hashes they generate. Our findings show that all variants generated with WASM-MUTATE are correct, i.e., they generate the correct hashes and execute without error. Additionally, we found that 19% of the generated variants surpassed the original cryptojacking binaries in performance.

WebAssembly variants correctness: To evaluate the correctness of the malware variants created with WASM-MUTATE, we focused on six binaries that we could build and execute end-to-end, as these had all three components outlined in Figure 4.1. We select only six binaries because the process of building and executing the binaries involves three components: the WebAssembly binary, its JavaScript complement, and the miner pool. These components were not found for the remaining 24 evaded binaries in the study subjects. For the six binaries, we then replace the original WebAssembly code with variants generated using VirusTotal as the malware oracle and WASM-MUTATE for both controlled and stochastic diversification configurations. We then execute both the original and the generated variants. We assess the correctness of the variants by examining the hashes they generate. Our findings show that all variants generated with WASM-MUTATE are correct, i.e., they generate the correct hashes and execute without error. Additionally, we found that 19% of the generated variants surpassed the original cryptojacking binaries in performance.

Suggestions

variants

delete 'variants' by ''

Happy suggestion

Suggestions

protection

replace 'protection' by 'protection.'

Happy suggestion

Defensive Diversification: speculative side-channel protection.

Defensive Diversification: speculative side-channel protection

Suggestions

protection.

the

delete 'the' by ''

Happy suggestion

Reflection Malware detection presents a challenging and well-known issue [150]. While there are considerable efforts on preventing malware in WebAssembly, the current literature acknowledges only metadata obfuscation or total absence of obfuscation techniques for WebAssembly [26, 27, 29, 30, 28]. As explored in Section 2.2, a software diversification engine could potentially serve as an obfuscator. We exhibit this potential with WASM-MUTATE. Moreover, our software diversification tools offer a feasible method to improve the precision of WebAssembly malware detection systems. Existing tools could enhance their evaluation dataset of WebAssembly malware by incorporating variants generated by WASM-MUTATE.

Reflection Malware detection presents a challenging and well-known issue [150]. While there are considerable efforts on preventing malware in WebAssembly, the current literature acknowledges only metadata (WebAssembly custom sections) obfuscation or total absence of obfuscation techniques for WebAssembly [26, 27, 29, 30, 28]. As explored in Section 2.2, a software diversification engine could potentially serve as an obfuscator. We exhibit this potential with WASM-MUTATE. Moreover, our software diversification tools offer a feasible method to improve the precision of WebAssembly malware detection systems. Existing tools could enhance their evaluation dataset of WebAssembly malware by incorporating the variants generated by WASM-MUTATE.

Suggestions

4.3).

replace '4.3).' by '4.3.'

Happy suggestion

The fundamental advantage of using WebAssembly in FaaS platforms lies in its ability to encapsulate thousands of WebAssembly binaries within a singular host process. A developer could compile its source code into a WebAssembly program suitable for the cloud platform and then submit it (in Figure 4.3). This host process is then disseminated across a network of servers and data centers (2) in Figure 4.3. These platforms convert WebAssembly programs into native code, which is subsequently executed in a sandboxed environment. Host processes can then instantiate new WebAssembly sandboxes for each client function, executing them in response to specific user requests with nanosecond-level latency (@) in Figure 4.3. This architecture inherently isolates WebAssembly binary executions from each other as well as from the host process, enhancing security.

The fundamental advantage of using WebAssembly in FaaS platforms lies in its ability to encapsulate thousands of WebAssembly binaries within a singular host process. A developer could compile its source code into a WebAssembly program suitable for the cloud platform and then submit it (in Figure 4.3). This host process is then disseminated across a network of servers and data centers (2) in Figure 4.3). These platforms convert WebAssembly programs into native code, which is subsequently executed in a sandboxed environment. Host processes can then instantiate new WebAssembly sandboxes for each client function, executing them in response to specific user requests with nanosecond-level latency (@) in Figure 4.3). This architecture inherently isolates WebAssembly binary executions from each other as well as from the host process, enhancing security.

Suggestions

4.3.

delete '\' by ''

Happy suggestion

Source Code Developer Computer Upload — HTTP request Memory isolation is violated | Memory boundary Host , Cloud node process 1 1 I NSS | i @) X86 1 1 1 !

Source Code Developer Computer Upload — HTTP request Memory isolation is violated | Memory boundary Host , Cloud node process 1 1 I NSS | i @) X86 1 ' 1 1 ! \

Suggestions

4.3.

attacks

replace 'attacks' by 'attacks.'

Happy suggestion

Threat model: speculative side-channel attacks.

Threat model: speculative side-channel attacks

Suggestions

attacks.

process

replace 'process' by 'process.'

Happy suggestion

Source Code Software Diversification Developer Computer request HTTP Memory isolation M bound. is violated MEY OUNCE, X86 Host _ Cloud node process.

Source Code Software Diversification Developer Computer request HTTP Memory isolation M bound. is violated MEY OUNCE, X86 Host _ Cloud node process

Suggestions

process.

replace 'in' by 'In'

Happy suggestion

To empirically demonstrate that Software Diversification can indeed mitigate Spectre vulnerabilities, we reuse the WebAssembly attack scenarios proposed by Narayan et al. In their work on Swivel [63]. Swivel is a compiler-based strategy designed to counteract Spectre attacks on WebAssembly binaries by linearizing their control flow during machine code compilation. Our approach differs from theirs in that it is binary-based, compiler-agnostic, and platform-agnostic; we do not propose altering the deployment or toolchain of FaaS platforms.

To empirically demonstrate that Software Diversification can indeed mitigate Spectre vulnerabilities, we reuse the WebAssembly attack scenarios proposed by Narayan et al. in their work on Swivel [63]. Swivel is a compiler-based strategy designed to counteract Spectre attacks on WebAssembly binaries by linearizing their control flow during machine code compilation. Our approach differs from theirs in that it is binary-based, compiler-agnostic, and platform-agnostic; we do not propose altering the deployment or toolchain of FaaS platforms.

Suggestions

insert '' by 'Method'

Happy suggestion

Methodology

Suggestions

Method

insert '' by 'Methodology'

Happy suggestion

Methodology

Suggestions

Methodology

Program Attack btb_breakout | Spectre branch target buffer (btb) btb_leakage | Spectre branch target buffer (btb) ret2spec Spectre Return Stack Buffer (rsb sb) pht Spectre Pattern History Table (pht)

Suggestions

(pht).

transformations

delete 'transformations' by ''

Happy suggestion

pht ret2spec s Ss Ss SF = * s & = Ss ‘HM 4 2 2 os Ss Ss Ss (8/4) Wapeapueg 1.0 8 0.0 a I * [> *: 1 % =e *, = Se, % a *, ee *s,, a, SSL ——— I * — ge 8 2 8 (8/4) Wapeapueg, Stacked

Wapeapueg,

replace 'ge' by '(8/4)'

Happy suggestion

pht ret2spec s Ss Ss SF = * s & = Ss ‘HM 4 2 2 os Ss Ss Ss (8/4) Wapeapueg 1.0 8 0.0 a I * [> *: 1 % =e *, = Se, % a *, ee *s,, a, SSL ——— I * — ge 8 2 8 (8/4) Wapeapueg, Stacked

Suggestions

(8/4)

—

———

SSL

replace 'SSL' by 'I'

Suggestions

*s,,

replace 'a' by 'ee'

Happy suggestion

pht ret2spec s Ss Ss SF = * s & = Ss ‘HM 4 2 2 os Ss Ss Ss (8/4) Wapeapueg 1.0 8 0.0 a I * [> *: 1 % =e *, = Se, % a *, ee *s,, a, SSL ——— I * — ge 8 2 8 (8/4) Wapeapueg, Stacked

Suggestions

replace '%' by '*,'

Happy suggestion

pht ret2spec s Ss Ss SF = * s & = Ss ‘HM 4 2 2 os Ss Ss Ss (8/4) Wapeapueg 1.0 8 0.0 a I * [> *: 1 % =e *, = Se, % a *, ee *s,, a, SSL ——— I * — ge 8 2 8 (8/4) Wapeapueg, Stacked

Suggestions

replace '0.0' by 'I'

Happy suggestion

pht ret2spec s Ss Ss SF = * s & = Ss ‘HM 4 2 2 os Ss Ss Ss (8/4) Wapeapueg 1.0 8 0.0 a I * [> *: 1 % =e *, = Se, % a *, ee *s,, a, SSL ——— I * — ge 8 2 8 (8/4) Wapeapueg, Stacked

replace 'Ss' by 'Wapeapueg'

Happy suggestion

pht ret2spec s Ss Ss SF = * s & = Ss ‘HM 4 2 2 os Ss Ss Ss (8/4) Wapeapueg 1.0 8 0.0 a I * [> *: 1 % =e *, = Se, % a *, ee *s,, a, SSL ——— I * — ge 8 2 8 (8/4) Wapeapueg, Stacked

Suggestions

Wapeapueg

replace 'Ss' by '(8/4)'

Happy suggestion

pht ret2spec s Ss Ss SF = * s & = Ss ‘HM 4 2 2 os Ss Ss Ss (8/4) Wapeapueg 1.0 8 0.0 a I * [> *: 1 % =e *, = Se, % a *, ee *s,, a, SSL ——— I * — ge 8 2 8 (8/4) Wapeapueg, Stacked

Suggestions

(8/4)

‘HM

‘HM

Strength:

delete 'Strength:' by ''

Happy suggestion

For the binaries btb_breakout and btb_leakage, WASM-MUTATE exhibits a high level of effectiveness, generating variants that leak less information than the original in 78% and 70% of instances, respectively. For both programs, after applying 200 stacked transformations, the exfiltration bandwidth drops to zero. This implies that WASM-MUTATE is capable of synthesizing variants that are entirely protected from the original attack. If we consider the results in Table 3.1, generating a variant with 200 stacked transformations can be accomplished in just a matter of seconds for a single WebAssembly binary.

Population Strength: For the binaries btb_breakout and btb_leakage, WASM-MUTATE exhibits a high level of effectiveness, generating variants that leak less information than the original in 78% and 70% of instances, respectively. For both programs, after applying 200 stacked transformations, the exfiltration bandwidth drops to zero. This implies that WASM-MUTATE is capable of synthesizing variants that are entirely protected from the original attack. If we consider the results in Table 3.1, generating a variant with 200 stacked transformations can be accomplished in just a matter of seconds for a single WebAssembly binary.

Suggestions

Population

delete 'Population' by ''

Happy suggestion

Suggestions

transformations

delete 'transformations' by ''

Happy suggestion

N a Bandwidth (b/s) _ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss FF SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations.

N a Bandwidth (b/s) _ ~ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss se Ss FF © SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations

Suggestions

Stacked

Stacked

LSS

replace 'LSS' by 'transformations'

Happy suggestion

N a Bandwidth (b/s) _ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss FF SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations.

N a Bandwidth (b/s) _ ~ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss se Ss FF © SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations

Suggestions

transformations

FFF

replace 'FFF' by 'Stacked'

Happy suggestion

N a Bandwidth (b/s) _ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss FF SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations.

N a Bandwidth (b/s) _ ~ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss se Ss FF © SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations

Suggestions

Stacked

El)

replace 'El)' by 'SF'

Happy suggestion

N a Bandwidth (b/s) _ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss FF SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations.

N a Bandwidth (b/s) _ ~ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss se Ss FF © SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations

Suggestions

Weve.

Weve.

(b/s)

replace '(b/s)' by 'a'

Happy suggestion

N a Bandwidth (b/s) _ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss FF SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations.

N a Bandwidth (b/s) _ ~ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss se Ss FF © SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations

Suggestions

Bandwidth

(b/s)

insert '' by 'Bandwidth'

Happy suggestion

N a Bandwidth (b/s) _ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss FF SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations.

N a Bandwidth (b/s) _ ~ Nn > uw S S on S So Bandwidth (b/s) S a 8 a Weve. El) s -= Ss SF FF Ss s Ss se Ss FF © SF S SF FFF LSS S SMe FFF PF oS Stacked transformations Stacked transformations

Suggestions

Bandwidth

S S

need

there

whether

insert '' by 'of'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

insert '' by 'question'

Happy suggestion

Then there is the question of whether or not there is a need for it.

Suggestions

question

insert '' by 'the'

Figure 4.6: Impact of WASM-MUTATE over ret2spec and pht binaries. The Y-axis denotes eaxfiltration bandwidth, with the original binary’s bandwidth under attack highlighted by a blue marker and dashed line. Variants are clustered in groups of 100 stacked transformations, denoted by green violinplots. Overall, for both programs approximately 70% of the variants have less data leakage bandwidth.

Suggestions

programs,

btb_breakout

replace 'btb_breakout' by 'btb_breakout.'

Happy suggestion

Code from original btb_breakout.

Code from original btb_breakout

Suggestions

btb_breakout.

insert '' by 'cache'

Happy suggestion

Disrupting timers to measure cache timing side-channel attacks, including for the four binaries analyzed in this use case, depend on precise timers to measure cache access times. Disrupting these timers can effectively neutralize the attack [152]. One key reason our results show variants resilient to Spectre attacks is the approach of WASM-MUTATE. It creates variants that offer a similar approach. Our WebAssembly variants introduce perturbations in the timing steps of WebAssembly variants. This is illustrated in Listing 4.1 and Listing 4.2, where the former shows the original time measurement and the latter presents a variant with introduced operations. By introducing additional instructions, the inherent randomness in the time measurement of a single or a few instructions is amplified, thereby reducing the timer’s accuracy.

Disrupting timers: Cache timing side-channel attacks, including for the four binaries analyzed in this use case, depend on precise timers to measure cache access times. Disrupting these timers can effectively neutralize the attack [152]. One key reason our results show variants resilient to Spectre attacks is the approach of WASM-MUTATE. It creates variants that offer a similar approach. Our WebAssembly variants introduce perturbations in the timing steps of WebAssembly variants. This is illustrated in Listing 4.1 and Listing 4.2, where the former shows the original time measurement and the latter presents a variant with introduced operations. By introducing additional instructions, the inherent randomness in the time measurement of a single or a few instructions is amplified, thereby reducing the timer’s accuracy.

Suggestions

cache

insert '' by 'measure'

Happy suggestion

Suggestions

measure

Cache

Effectiveness of WASM-MUTATE: As illustrated in Figure 4.6, similarly to Figure 4.5, WASM-MUTATE significantly impacts the programs ret2spec and pht when subjected to their respective attacks. In 76% of instances for ret2spec and 71% for pht, the generated variants demonstrated reduced attack bandwidth compared to the original binaries. The plots reveal that a notable decrease in exfiltration bandwidth occurs after applying at least 100 stacked transformations. While both programs show signs of hardening through reduced attack bandwidth, this effect is not immediate and requires a substantial number of transformations to become effective. Additionally, the bandwidth distribution is more varied for these two programs compared to the two previous ones. Our analysis suggests a correlation between the reduction in attack bandwidth and the complexity of the binary being diversified. Specifically, ret2spec and pht are substantially larger programs, containing over 300,000 instructions, compared to btb_breakout and btb_leakage, which have fewer than 800 instructions. Therefore, given that WASM-MUTATE performs one transformation per invocation, the probability of affecting critical components to hinder attacks decreases in larger binaries.

Suggestions

delete 'of' by ''

Happy suggestion

Suggestions

Effectiveness

delete 'Effectiveness' by ''

Happy suggestion

Suggestions

optimization

replace 'optimization' by 'optimization.'

Happy suggestion

Train the code to jump here (index 1) (132.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization.

train the code to jump here (index 1) (132.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization

Suggestions

optimization.

train

replace 'train' by 'Train'

Happy suggestion

Train the code to jump here (index 1) (132.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization.

train the code to jump here (index 1) (132.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization

Suggestions

Train

train

This sentence does not start with an uppercase letter.

Happy suggestion

train the code to jump here (index 1) (132.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization

Suggestions

Train

replace '

Happy suggestion

(call $readTimer) (set_local $end_time) inserted instructions> access to mem inserted instructions> (i64.sub (get_local $end_time) (get_local $start_time)) (set_local $duration)

(call $readTimer) (set_local $end_time) access to mem (i64.sub (get_local $end_time) (get_local $start_time)) (set_local $duration)

Suggestions

inserted

code

replace 'code' by 'code.'

Happy suggestion

Variant code.

Variant code

Suggestions

code.

transiently

replace 'transiently' by 'Transiently'

Happy suggestion

Transiently jump here (132.load (i32.const 339968)) S(83) is the secret (i32.store (i32.const 83)) just prevent optimization Listing 4.3: Two jump locations. The top one trains the branch predictor, the bottom one is the expected jump that exfiltrates the memory access.

transiently jump here (132.load (i32.const 339968)) S(83) is the secret (i32.store (i32.const 83)) just prevent optimization Listing 4.3: Two jump locations. The top one trains the branch predictor, the bottom one is the expected jump that exfiltrates the memory access.

Suggestions

Transiently

transiently

This sentence does not start with an uppercase letter.

Happy suggestion

Suggestions

Transiently

inserted

transiently

replace 'transiently' by 'Transiently'

Happy suggestion

Transiently jump here inserted instructions> (i32.load (i32.const 339968)) inserted instructions> (i32.store (i32.const 83)) "S"(83) is the secret just prevent optimization.

transiently jump here (i32.load (i32.const 339968)) (i32.store (i32.const 83)) "S"(83) is the secret just prevent optimization

Suggestions

Transiently

transiently

This sentence does not start with an uppercase letter.

Happy suggestion

transiently jump here (i32.load (i32.const 339968)) (i32.store (i32.const 83)) "S"(83) is the secret just prevent optimization

Suggestions

Transiently

optimization

replace 'optimization' by 'optimization.'

Happy suggestion

Train the code to jump here (index 1) inserted instructions> (i32.load (i32.const 2000)) inserted instructions> (i32.store (i32.const 83)) just prevent optimization.

train the code to jump here (index 1) (i32.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization

Suggestions

optimization.

replace '

Happy suggestion

Train the code to jump here (index 1) inserted instructions> (i32.load (i32.const 2000)) inserted instructions> (i32.store (i32.const 83)) just prevent optimization.

train the code to jump here (index 1) (i32.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization

Suggestions

inserted

train

replace 'train' by 'Train'

Happy suggestion

Train the code to jump here (index 1) inserted instructions> (i32.load (i32.const 2000)) inserted instructions> (i32.store (i32.const 83)) just prevent optimization.

train the code to jump here (index 1) (i32.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization

Suggestions

Train

train

This sentence does not start with an uppercase letter.

Happy suggestion

train the code to jump here (index 1) (i32.load (i32.const 2000)) (i32.store (i32.const 83)) just prevent optimization

Suggestions

Train

impact:

delete 'impact:' by ''

Happy suggestion

The success in diminishing Spectre attacks is mainly explained by the fact that WASM-MUTATE synthesizes variants that effectively alter memory access patterns. We have identified four primary factors responsible for the divergence in memory accesses among WASM-MUTATE generated variants. First, modifications to the binary layout—even those that do not affect executed code—inevitably alter memory accesses within the program’s stack. Specifically, WASM-MUTATE generates variants that modify the return addresses of functions, which consequently leads to differences in execution flow and memory accesses. Second, one of our rewriting rules incorporates artificial global values into WebAssembly binaries. The access to these global variables inevitably affects the managed memory (see Section 2.1.3). Third, WASM-MUTATE injects ‘phantom’ instructions which do not aim to modify the outcome of a transformed function during execution. These intermediate calculations trigger the spill/reload component of the wasmtime compiler, varying spill and reload operations. In the context of limited physical resources, these operations temporarily store values in memory for later retrieval and use, thus creating diverse managed memory accesses (see the example at Section 3.3.1). Finally, certain rewriting rules implemented by WASM-MUTATE replicate fragments of code, e.g., performing commutative operations. These code segments may contain memory accesses, and while neither the memory addresses nor their values change, the frequency of these operations does.

Managed memory impact: The success in diminishing Spectre attacks is mainly explained by the fact that WASM-MUTATE synthesizes variants that effectively alter memory access patterns. We have identified four primary factors responsible for the divergence in memory accesses among WASM-MUTATE generated variants. First, modifications to the binary layout—even those that do not affect executed code—inevitably alter memory accesses within the program’s stack. Specifically, WASM-MUTATE generates variants that modify the return addresses of functions, which consequently leads to differences in execution flow and memory accesses. Second, one of our rewriting rules incorporates artificial global values into WebAssembly binaries. The access to these global variables inevitably affects the managed memory (see Section 2.1.3). Third, WASM-MUTATE injects ‘phantom’ instructions which do not aim to modify the outcome of a transformed function during execution. These intermediate calculations trigger the spill/reload component of the wasmtime compiler, varying spill and reload operations. In the context of limited physical resources, these operations temporarily store values in memory for later retrieval and use, thus creating diverse managed memory accesses (see the example at Section 3.3.1). Finally, certain rewriting rules implemented by WASM-MUTATE replicate fragments of code, e.g., performing commutative operations. These code segments may contain memory accesses, and while neither the memory addresses nor their values change, the frequency of these operations does.

Suggestions

memory

delete 'memory' by ''

Happy suggestion

Suggestions

Managed

delete 'Managed' by ''

Happy suggestion

Suggestions

Diversification

replace 'Diversification' by 'diversification'

Happy suggestion

In this chapter, we explore Offensive and Defensive Software Diversification applied to WebAssembly. Offensive Software Diversification highlights both the potential and the latent security risks in applying Software Diversification to WebAssembly malware. Our findings suggest potential enhancements to the automatic detection of cryptojacking malware in WebAssembly, e.g., by stressing their resilience with WebAssembly malware variants. Conversely, defensive software diversification serves as a proactive guard, specifically designed to mitigate the risks associated with Spectre attacks.

In this chapter, we explore Offensive and Defensive Software Diversification applied to WebAssembly. Offensive Software Diversification highlights both the potential and the latent security risks in applying Software Diversification to WebAssembly malware. Our findings suggest potential enhancements to the automatic detection of cryptojacking malware in WebAssembly, e.g., by stressing their resilience with WebAssembly malware variants. Conversely, Defensive Software Diversification serves as a proactive guard, specifically designed to mitigate the risks associated with Spectre attacks.

Suggestions

diversification

Software

replace 'Software' by 'software'

Happy suggestion

In this chapter, we explore Offensive and Defensive Software Diversification applied to WebAssembly. Offensive Software Diversification highlights both the potential and the latent security risks in applying Software Diversification to WebAssembly malware. Our findings suggest potential enhancements to the automatic detection of cryptojacking malware in WebAssembly, e.g., by stressing their resilience with WebAssembly malware variants. Conversely, Defensive Software Diversification serves as a proactive guard, specifically designed to mitigate the risks associated with Spectre attacks.

Suggestions

software

Defensive

replace 'Defensive' by 'defensive'

Happy suggestion

In this chapter, we explore Offensive and Defensive Software Diversification applied to WebAssembly. Offensive Software Diversification highlights both the potential and the latent security risks in applying Software Diversification to WebAssembly malware. Our findings suggest potential enhancements to the automatic detection of cryptojacking malware in WebAssembly, e.g., by stressing their resilience with WebAssembly malware variants. Conversely, Defensive Software Diversification serves as a proactive guard, specifically designed to mitigate the risks associated with Spectre attacks.

Suggestions

defensive

Conclusions

replace 'Conclusions' by 'Conclusions.'

Happy suggestion

Conclusions.

Conclusions

Suggestions

Conclusions.

contributions

replace 'contributions' by 'contributions.'

Happy suggestion

Summary of technical contributions.

Summary of technical contributions

Suggestions

contributions.

This

replace 'This' by 'thing.'

Happy suggestion

This thesis contributes to this effort with a comprehensive set of methods and tools for Software Diversification for WebAssembly. We introduce three technical contributions in this dissertation: CROW, MEWE, and WASM-MUTATE. Additionally, we present two use cases for exploiting the diversification created for WebAssembly programs. In this chapter, we summarize the technical contributions of this dissertation, including an overview of the empirical findings of our research. Finally, we discuss future research directions in WebAssembly Software Diversification. ‘i growing adoption of WebAssembly requires hardening techniques. This is a good thing.

thesis contributes to this effort with a comprehensive set of methods and tools for Software Diversification for WebAssembly. We introduce three technical contributions in this dissertation: CROW, MEWE, and WASM-MUTATE. Additionally, we present two use cases for exploiting the diversification created for WebAssembly programs. In this chapter, we summarize the technical contributions of this dissertation, including an overview of the empirical findings of our research. Finally, we discuss future research directions in WebAssembly Software Diversification. ‘i growing adoption of WebAssembly requires hardening techniques. This

Suggestions

thing.

techniques.

replace 'techniques.' by 'good'

Happy suggestion

Suggestions

good

hardening

replace 'hardening' by 'a'

replace 'growing' by 'requires'

Happy suggestion

Suggestions

requires

‘i

replace '‘i' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

‘i

directions

replace 'directions' by 'Diversification.'

Happy suggestion

Suggestions

Diversification.

research

replace 'research' by 'Software'

Happy suggestion

Suggestions

Software

future

replace 'future' by 'WebAssembly'

Happy suggestion

Suggestions

WebAssembly

discuss

replace 'discuss' by 'in'

Happy suggestion

Suggestions

replace 'we' by 'directions'

Happy suggestion

Suggestions

directions

Finally,

replace 'Finally,' by 'research'

Happy suggestion

Suggestions

research

research.

replace 'research.' by 'future'

Happy suggestion

Suggestions

future

Finally,

empirical

replace 'empirical' by 'research.'

Happy suggestion

Suggestions

research.

the

replace 'the' by 'our'

Happy suggestion

Suggestions

overview

delete 'overview' by ''

Happy suggestion

Suggestions

delete 'an' by ''

Suggestions

insert '' by 'overview'

Happy suggestion

Suggestions

overview

contributions

replace 'contributions' by 'an'

contributions

summarize

for

replace 'for' by 'chapter,'

Happy suggestion

Suggestions

chapter,

created

replace 'created' by 'this'

Happy suggestion

Suggestions

this

diversification

replace 'diversification' by 'In'

Happy suggestion

Suggestions

the

replace 'the' by 'programs.'

Happy suggestion

Suggestions

programs.

diversification

cases

replace 'cases' by 'the'

Happy suggestion

Suggestions

use

replace 'use' by 'exploiting'

Happy suggestion

Suggestions

exploiting

present

and

replace 'and' by 'we'

CROW,

contributions

replace 'contributions' by 'dissertation:'

Happy suggestion

Suggestions

dissertation:

technical

replace 'technical' by 'this'

Happy suggestion

Suggestions

this

technical

WebAssembly.

replace 'WebAssembly.' by 'three'

Happy suggestion

Suggestions

three

for

replace 'for' by 'introduce'

Happy suggestion

Suggestions

introduce

Diversification

replace 'Diversification' by 'We'

Happy suggestion

CONCLUSIONS AND FUTURE WORK.

CONCLUSIONS AND FUTURE WORK

Suggestions

WORK.

CROW,

replace 'CROW,' by 'Crow,'

Happy suggestion

We have developed three open-source tools that are publicly accessible: Crow, MEWE, and WASM-MUTATE. CROW and MEWE explore a compiler-based approach, whereas WASM-MUTATE employs a method based on binary. These tools automate the process of diversification, thereby increasing their practicality for deployment. At present, WASM-MUTATE is integrated into the wasmtime project! to improve testing. Our tools are complementary, providing combined utility. For instance, when the source code for a WebAssembly binary is unavailable, WASM-MUTATE offers an efficient solution for the generation of code variants. On the other hand, CROW and MEWE are particularly suited for scenarios that require a high level of variant preservation. Finally, one can use CROW and MEWE to generate a set of variants, which can then serve as rewriting rules for WASM-MUTATE. Moreover, when practitioners need to quickly generate variants, they could employ WASM-MUTATE, despite a potential decrease in the preservation of variants.

We have developed three open-source tools that are publicly accessible: CROW, MEWE, and WASM-MUTATE. CROW and MEWE explore a compiler-based approach, whereas WASM-MUTATE employs a method based on binary. These tools automate the process of diversification, thereby increasing their practicality for deployment. At present, WASM-MUTATE is integrated into the wasmtime project! to improve testing. Our tools are complementary, providing combined utility. For instance, when the source code for a WebAssembly binary is unavailable, WASM-MUTATE offers an efficient solution for the generation of code variants. On the other hand, CROW and MEWE are particularly suited for scenarios that require a high level of variant preservation. Finally, one can use CROW and MEWE to generate a set of variants, which can then serve as rewriting rules for WASM-MUTATE. Moreover, when practitioners need to quickly generate variants, they could employ WASM-MUTATE, despite a potential decrease in the preservation of variants.

Suggestions

Crow,

lhttps

This sentence does not start with an uppercase letter.

Happy suggestion

lhttps://github.com/bytecodealliance/wasm-tools

Suggestions

Lhttps

thesis

replace 'thesis' by 'thesis.'

Happy suggestion

Key results of the thesis.

Key results of the thesis

Suggestions

thesis.

Work

replace 'Work' by 'Work.'

Happy suggestion

Future Work.

Future Work

Suggestions

Work.

Diversification

replace 'Diversification' by 'diversification'

Happy suggestion

Remarkably, we ensure the rapid transformation of WebAssembly binaries, creating thousands of variants in a matter of minutes. This swift generation of variants is particularly advantageous in highly dynamic scenarios such as FaaS and CDN platforms. In this work, we do not discuss this case in depth. Yet, we have empirically tested the effectiveness of moving target defense techniques [37]. These tests were conducted on the Fastly edge computing platform. In this scenario, we incorporate multivariant executions [37]. Fastly can redeploy a WebAssembly binary across its 73 data centers worldwide in 13 seconds on average. This enables the practical deployment of a unique variant per node using our tools. However, a 13-second window may still pose a risk despite each node potentially hosting a distinct WebAssembly variant. To mitigate this, one could use multivariant binaries, invoking a unique variant every time the node is invoked. Our tools can generate dozens of unique variants every few seconds, each serving as a multivariant binary packaging thousands of other variants. This illustrates the real-world application of defensive software diversification to a WebAssembly standalone scenario.

Remarkably, we ensure the rapid transformation of WebAssembly binaries, creating thousands of variants in a matter of minutes. This swift generation of variants is particularly advantageous in highly dynamic scenarios such as FaaS and CDN platforms. In this work, we do not discuss this case in depth. Yet, we have empirically tested the effectiveness of moving target defense techniques [37]. These tests were conducted on the Fastly edge computing platform. In this scenario, we incorporate multivariant executions [37]. Fastly can redeploy a WebAssembly binary across its 73 data centers worldwide in 13 seconds on average. This enables the practical deployment of a unique variant per node using our tools. However, a 13-second window may still pose a risk despite each node potentially hosting a distinct WebAssembly variant. To mitigate this, one could use multivariant binaries, invoking a unique variant every time the node is invoked. Our tools can generate dozens of unique variants every few seconds, each serving as a multivariant binary packaging thousands of other variants. This illustrates the real-world application of Defensive Software Diversification to a WebAssembly standalone scenario.

Suggestions

diversification

Software

replace 'Software' by 'software'

Happy suggestion

Remarkably, we ensure the rapid transformation of WebAssembly binaries, creating thousands of variants in a matter of minutes. This swift generation of variants is particularly advantageous in highly dynamic scenarios such as FaaS and CDN platforms. In this work, we do not discuss this case in depth. Yet, we have empirically tested the effectiveness of moving target defense techniques [37]. These tests were conducted on the Fastly edge computing platform. In this scenario, we incorporate multivariant executions [37]. Fastly can redeploy a WebAssembly binary across its 73 data centers worldwide in 13 seconds on average. This enables the practical deployment of a unique variant per node using our tools. However, a 13-second window may still pose a risk despite each node potentially hosting a distinct WebAssembly variant. To mitigate this, one could use multivariant binaries, invoking a unique variant every time the node is invoked. Our tools can generate dozens of unique variants every few seconds, each serving as a multivariant binary packaging thousands of other variants. This illustrates the real-world application of Defensive Software Diversification to a WebAssembly standalone scenario.

Suggestions

software

Defensive

replace 'Defensive' by 'defensive'

Happy suggestion

Remarkably, we ensure the rapid transformation of WebAssembly binaries, creating thousands of variants in a matter of minutes. This swift generation of variants is particularly advantageous in highly dynamic scenarios such as FaaS and CDN platforms. In this work, we do not discuss this case in depth. Yet, we have empirically tested the effectiveness of moving target defense techniques [37]. These tests were conducted on the Fastly edge computing platform. In this scenario, we incorporate multivariant executions [37]. Fastly can redeploy a WebAssembly binary across its 73 data centers worldwide in 13 seconds on average. This enables the practical deployment of a unique variant per node using our tools. However, a 13-second window may still pose a risk despite each node potentially hosting a distinct WebAssembly variant. To mitigate this, one could use multivariant binaries, invoking a unique variant every time the node is invoked. Our tools can generate dozens of unique variants every few seconds, each serving as a multivariant binary packaging thousands of other variants. This illustrates the real-world application of Defensive Software Diversification to a WebAssembly standalone scenario.

Suggestions

defensive

programs

replace 'programs' by 'programs.'

Happy suggestion

Data augmentation for Machine Learning on WebAssembly programs.

Data augmentation for Machine Learning on WebAssembly programs

Suggestions

programs.

insert '' by 'span.'

Happy suggestion

In the context of WebAssembly, this process presents particularly challenging aspects since it is highly dynamic [17]. For instance, within a browser context, we need to ensure the WebAssembly binary varies not only per browser instance but also per tab process (webpage tab). In the backend, we must guarantee that the WebAssembly binary is unique per cold spawn [50, 63]. Hence, it becomes necessary to ensure that the diversification process is both rapid and efficient, capable of generating a vast number of variants within a brief time span. Specifically, this entails producing millions of unique and diverse variants every second.

In the context of WebAssembly, this process presents particularly challenging aspects since it is highly dynamic [17]. For instance, within a browser context, we need to ensure the WebAssembly binary varies not only per browser instance but also per tab process (webpage tab). In the backend, we must guarantee that the WebAssembly binary is unique per cold spawn [50, 63]. Hence, it becomes necessary to ensure that the diversification process is both rapid and efficient, capable of generating a vast number of variants within a brief timespan. Specifically, this entails producing millions of unique and diverse variants every second.

Suggestions

span.

timespan.

replace 'timespan.' by 'time'

Happy suggestion

In the context of WebAssembly, this process presents particularly challenging aspects since it is highly dynamic [17]. For instance, within a browser context, we need to ensure the WebAssembly binary varies not only per browser instance but also per tab process (webpage tab). In the backend, we must guarantee that the WebAssembly binary is unique per cold spawn [50, 63]. Hence, it becomes necessary to ensure that the diversification process is both rapid and efficient, capable of generating a vast number of variants within a brief timespan. Specifically, this entails producing millions of unique and diverse variants every second.

Suggestions

time

insert '' by 'shot”'

Happy suggestion

Oneshot diversification denotes the automatic creation of a unique software program variant with each installation or distribution. This procedure entails systematic alterations to the original program. The objective is to ensure that each software copy is distinctive from all others. Contrary to randomization, one-shot diversification usually happens during the software’s distribution or installation phase. The term “one shot” describes the diversification’s static nature following its one-time implementation per installation. Once used, the diversified program is discarded. In summary, oneshot diversification bolsters security and heightens reliability by diminishing the predictability of software. We therefore plan to investigate the feasibility of one-shot diversification in WebAssembly. However, we foresee several challenges, particularly the optimization of our previously presented tools.

Oneshot diversification denotes the automatic creation of a unique software program variant with each installation or distribution. This procedure entails systematic alterations to the original program. The objective is to ensure that each software copy is distinctive from all others. Contrary to randomization, oneshot diversification usually happens during the software’s distribution or installation phase. The term “oneshot” describes the diversification’s static nature following its one-time implementation per installation. Once used, the diversified program is discarded. In summary, oneshot diversification bolsters security and heightens reliability by diminishing the predictability of software. We therefore plan to investigate the feasibility of one-shot diversification in WebAssembly. However, we foresee several challenges, particularly the optimization of our previously presented tools.

Suggestions

shot”

“oneshot”

replace '“oneshot”' by '“one'

Happy suggestion

Oneshot diversification denotes the automatic creation of a unique software program variant with each installation or distribution. This procedure entails systematic alterations to the original program. The objective is to ensure that each software copy is distinctive from all others. Contrary to randomization, oneshot diversification usually happens during the software’s distribution or installation phase. The term “oneshot” describes the diversification’s static nature following its one-time implementation per installation. Once used, the diversified program is discarded. In summary, oneshot diversification bolsters security and heightens reliability by diminishing the predictability of software. We therefore plan to investigate the feasibility of one-shot diversification in WebAssembly. However, we foresee several challenges, particularly the optimization of our previously presented tools.

Suggestions

“one

oneshot

replace 'oneshot' by 'one-shot'

Happy suggestion

Oneshot diversification denotes the automatic creation of a unique software program variant with each installation or distribution. This procedure entails systematic alterations to the original program. The objective is to ensure that each software copy is distinctive from all others. Contrary to randomization, oneshot diversification usually happens during the software’s distribution or installation phase. The term “oneshot” describes the diversification’s static nature following its one-time implementation per installation. Once used, the diversified program is discarded. In summary, oneshot diversification bolsters security and heightens reliability by diminishing the predictability of software. We therefore plan to investigate the feasibility of one-shot diversification in WebAssembly. However, we foresee several challenges, particularly the optimization of our previously presented tools.

Suggestions

one-shot

Diversification

replace 'Diversification' by 'Diversification.'

Happy suggestion

Oneshot Diversification.

Oneshot Diversification

Suggestions

Diversification.

insert '' by 'Object-Oriented'

Happy suggestion

[3] A. Guha, C. Saftoiu, and S. Krishnamurthi, “The Essence of JavaScript,” in ECOOP 2010 - Object-Oriented Programming, vol. 6183, pp. 126-150, 2010.

[3] A. Guha, C. Saftoiu, and S. Krishnamurthi, “The Essence of JavaScript,” in ECOOP 2010 -Object-Oriented Programming, vol. 6183, pp. 126-150, 2010.

Suggestions

Object-Oriented

https://www.w3.org/People/Berners-Lee/WorldWideWeb.html,

abs/1912.02285,

replace 'abs/1912.02285,' by 'Abs/1912.02285,'

Happy suggestion

[9] S. Narayan, T. Garfinkel, S. Lerner, H. Shacham, and D. Stefan, “Gobi: WebAssembly as a Practical Path to Library Sandboxing,” CoRR, vol. Abs/1912.02285, 2019.

[9] S. Narayan, T. Garfinkel, S. Lerner, H. Shacham, and D. Stefan, “Gobi: WebAssembly as a Practical Path to Library Sandboxing,” CoRR, vol. abs/1912.02285, 2019.

Suggestions

Abs/1912.02285,

“metaSafer:

replace '“metaSafer:' by '“MetaSafer:'

Happy suggestion

[19] S. Song, S. Park, and D. Kwon, “MetaSafer: A Technique to Detect Heap Metadata Corruption in WebAssembly,” IEEE Access, vol. 11, pp. 124887-— 124898, 2023.

[19] S. Song, S. Park, and D. Kwon, “metaSafer: A Technique to Detect Heap Metadata Corruption in WebAssembly,” IEEE Access, vol. 11, pp. 124887-— 124898, 2023.

Suggestions

“MetaSafer:

Unpaired symbol: ‘"’ seems to be missing

Happy suggestion

[18] T. Rokicki, C. Maurice, M. Botvinnik, and Y. Oren, “Port Contention Goes Portable: Port Contention Side Channels in Web Browsers,” in ASIA CCS "22: ACM Asia Conference on Computer and Communications Security, pp. 1182-1194, 2022.

Suggestions

[

Unpaired symbol: ‘]’ seems to be missing

Happy suggestion

[17] M. N. Hoque and K. A. Harras, “WebAssembly for Edge Computing: Potential and Challenges,” [EEE Communications Standards Magazine, vol. 6, no. 4, pp. 68-73, 2022.

https://www.nitrd.gov.

gov

This sentence does not start with an uppercase letter.

Happy suggestion

[15] NSA, “National Cyber Leap Year.” https://www.nitrd. gov/nitrdgroups/ index. php?title=National_Cyber_Leap_Year, 2021.

Suggestions

[

Unpaired symbol: ‘]’ seems to be missing

Happy suggestion

[21 Q. Stiévenart, C. D. Roover, and M. Ghafari, “Security Risks of Porting C Programs to Webassembly,” in SAC ’22: The 87th ACM/SIGAPP Symposium on Applied Computing, pp. 1713-1722, 2022.

Suggestions

“RAPID:

replace '“RAPID:' by '“RAPID'

Happy suggestion

[30] J. D. P. Rodriguez and J. Posegga, “RAPID Resource and API-based Detection Against In-browser Miners,” in Proceedings of the 34th Annual Computer Security Applications Conference, ACSAC 2018, San Juan, PR, USA, December 03-07, 2018, pp. 313-326, ACM, 2018.

[30] J. D. P. Rodriguez and J. Posegga, “RAPID: Resource and API-based Detection Against In-browser Miners,” in Proceedings of the 34th Annual Computer Security Applications Conference, ACSAC 2018, San Juan, PR, USA, December 03-07, 2018, pp. 313-326, ACM, 2018.

Suggestions

“RAPID

insert '' by '28th'

Suggestions

Secure

Hao

‘Hao’ is an imported foreign name or expression, which originally has a diacritic.

Happy suggestion

Suggestions

Hào

1{th

replace '1{th' by '1th'

Happy suggestion

[24] M. Musch, C. Wressnegger, M. Johns, and K. Rieck, “Thieves in the Browser: Web-based Cryptojacking in the Wild,” in Proceedings of the 1th International Conference on Availability, Reliability and Security, ARES 2019, Canterbury, UK, August 26-29, 2019, pp. 4:1-4:10, ACM, 2019.

[24] M. Musch, C. Wressnegger, M. Johns, and K. Rieck, “Thieves in the Browser: Web-based Cryptojacking in the Wild,” in Proceedings of the 1{th International Conference on Availability, Reliability and Security, ARES 2019, Canterbury, UK, August 26-29, 2019, pp. 4:1-4:10, ACM, 2019.

Suggestions

{

Unpaired symbol: ‘}’ seems to be missing

Happy suggestion

Suggestions

Speculative

delete 'Speculative' by ''

Happy suggestion

[23] G. Maisuradze and C. Rossow, “Speculative Execution Using Return Stack Buffers,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS, pp. 2109-2122, 2018.

[23] G. Maisuradze and C. Rossow, “ret2spec: Speculative Execution Using Return Stack Buffers,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS, pp. 2109-2122, 2018.

Suggestions

“ret2spec:

replace '“ret2spec:' by '“Speculative'

Happy suggestion

Suggestions

“Speculative

Non-web

replace 'Non-web' by 'Non-Web'

Happy suggestion

[43] B. Spies and M. Mock, “An Evaluation of WebAssembly in Non-Web Environments,” in XLVII Latin American Computing Conference, CLEI 2021, Cartago, Costa Rica, October 25-29, 2021, pp. 1-10, IKEE, 2021.

[43] B. Spies and M. Mock, “An Evaluation of WebAssembly in Non-web Environments,” in XLVII Latin American Computing Conference, CLEI 2021, Cartago, Costa Rica, October 25-29, 2021, pp. 1-10, IKEE, 2021.

Suggestions

Non-Web

lve?urn=urn:nbn:se:kth:diva-317331.

delete 'lve?urn=urn:nbn:se:kth:diva-317331.' by ''

Happy suggestion

[40] J. Cabrera Arteaga, “Artificial Software Diversification for WebAssembly,” No. 2022:52 in TRITA-EECS-AVL, p. 112, 2022. https://urn.kb.se/resolve?urn=urn:nbn:se:kth:diva-317331.

[40] J. Cabrera Arteaga, “Artificial Software Diversification for WebAssembly,” No. 2022:52 in TRITA-EECS-AVL, p. 112, 2022. https://urn.kb.se/reso lve?urn=urn:nbn:se:kth:diva-317331.

Institute

fiir

replace 'fiir' by 'for'

Happy suggestion

[54] F. Marques, J. Fragoso Santos, N. Santos, and P. Adao, “Concolic Execution for WebAssembly,” Schloss Dagstuhl-Leibniz-Zentrum for Informatik, 2022.

[54] F. Marques, J. Fragoso Santos, N. Santos, and P. Adao, “Concolic Execution for WebAssembly,” Schloss Dagstuhl-Leibniz-Zentrum fiir Informatik, 2022.

Suggestions

Comput.

replace 'Comput.' by 'Computer.'

Happy suggestion

[53] T. Brito, P. Lopes, N. Santos, and J. F. Santos, “Wasmati: An efficient static vulnerability scanner for WebAssembly,” Computer. Secur., vol. 118, p. 102745, 2022.

[53] T. Brito, P. Lopes, N. Santos, and J. F. Santos, “Wasmati: An efficient static vulnerability scanner for WebAssembly,” Comput. Secur., vol. 118, p. 102745, 2022.

Suggestions

Computer.

103,

delete '103,' by ''

Happy suggestion

[52] I. Bastys, M. Algehed, A. Sjésten, and A. Sabelfeld, “SecWasm Information Flow Control for WebAssembly,” in Static Analysis -29th International Symposium, SAS, vol. 13790 of Lecture Notes in Computer Science, pp. 74—103, Springer, 2022.

[52] I. Bastys, M. Algehed, A. Sjésten, and A. Sabelfeld, “SecWasm: Information Flow Control for WebAssembly,” in Static Analysis -29th International Symposium, SAS, vol. 13790 of Lecture Notes in Computer Science, pp. 74— 103, Springer, 2022.

Suggestions

74—

replace '74—' by '74—103,'

Happy suggestion

Suggestions

74—103,

“SecWasm:

replace '“SecWasm:' by '“SecWasm'

Happy suggestion

Suggestions

“SecWasm

loT

replace 'loT' by 'LoT'

Happy suggestion

[49] N. Makitalo, T. Mikkonen, C. Pautasso, V. Bankowski, P. Daubaris, R. Mikkola, and O. Beletski, “WebAssembly Modules as Lightweight Containers for Liquid LoT Applications,” in Proceedings of Web Engineering -21st International Conference, ICWE, vol. 12706, pp. 328-336, 2021.

[49] N. Makitalo, T. Mikkonen, C. Pautasso, V. Bankowski, P. Daubaris, R. Mikkola, and O. Beletski, “WebAssembly Modules as Lightweight Containers for Liquid loT Applications,” in Proceedings of Web Engineering -21st International Conference, ICWE, vol. 12706, pp. 328-336, 2021.

Suggestions

arXiv:2305.13241,

replace 'arXiv:2305.13241,' by 'ArXiv:2305.13241,'

Happy suggestion

[48] B. L. Titzer, “Whose baseline compiler is it anyway?,” arXiv e-prints, p. ArXiv:2305.13241, May 2023.

[48] B. L. Titzer, “Whose baseline compiler is it anyway?,” arXiv e-prints, p. arXiv:2305.13241, May 2023.

Suggestions

ArXiv:2305.13241,

Applications,”

replace 'Applications,”' by 'Applications,'

Happy suggestion

[46] Y. Yan, T. Tu, L. Zhao, Y. Zhou, and W. Wang, Understanding the Performance of Webassembly Applications, in Proceedings of the 21st ACM Internet Measurement Conference, IMC ’21, p. 533-549, 2021.

[46] Y. Yan, T. Tu, L. Zhao, Y. Zhou, and W. Wang, “Understanding the Performance of Webassembly Applications,” in Proceedings of the 21st ACM Internet Measurement Conference, IMC ’21, p. 533-549, 2021.

Suggestions

Applications,

“Understanding

replace '“Understanding' by 'Understanding'

Happy suggestion

Suggestions

Understanding

insert '' by 'transitions'

Happy suggestion

[64] M. Kolosick, 5. Narayan, E. Johnson, C. Watt, M. LeMay, D. Garg, R. Jhala, and D. Stefan, “Isolation Without Taxation: Near Zero-cost transitions for WebAssembly And SFI,” Proc. ACM Program. Lang., vol. 6, no. POPL, pp. 1-30, 2022.

[64] M. Kolosick, 5. Narayan, E. Johnson, C. Watt, M. LeMay, D. Garg, R. Jhala, and D. Stefan, “Isolation Without Taxation: Near-Zero-cost Transitions for WebAssembly And SFI,” Proc. ACM Program. Lang., vol. 6, no. POPL, pp. 1-30, 2022.

Suggestions

transitions

Transitions

replace 'Transitions' by 'Zero-cost'

Happy suggestion

Suggestions

Zero-cost

Near-Zero-cost

replace 'Near-Zero-cost' by 'Near'

Happy suggestion

Suggestions

Near

abs/1802.01050,

replace 'abs/1802.01050,' by 'Abs/1802.01050,'

Happy suggestion

[59] W. Fu, R. Lin, and D. Inge, “TaintAssembly: Taint-based Information Flow Control Tracking for WebAssembly,” CoRR, vol. Abs/1802.01050, 2018.

[59] W. Fu, R. Lin, and D. Inge, “TaintAssembly: Taint-based Information Flow Control Tracking for WebAssembly,” CoRR, vol. abs/1802.01050, 2018.

Suggestions

Abs/1802.01050,

Suggestions

“Wave:

Comput.

replace 'Comput.' by 'Computer.'

Happy suggestion

[74] T. Thiim, S. Apel, C. Kastner, I. Schaefer, and G. Saake, “A classification and survey of analysis strategies for software product lines,” ACM Computer. Surv., vol. 47, jun 2014.

[74] T. Thiim, S. Apel, C. Kastner, I. Schaefer, and G. Saake, “A classification and survey of analysis strategies for software product lines,” ACM Comput. Surv., vol. 47, jun 2014.

Suggestions

Computer.

ART

replace 'ART' by 'Art'

Happy suggestion

[72] T. Y. Chen, F. Kuo, R. G. Merkel, and T. H. Tse, “Adaptive Random Testing: The Art of test case diversity,” J. Syst. Softw., vol. 83, no. 1, pp. 60-66, 2010.

[72] T. Y. Chen, F. Kuo, R. G. Merkel, and T. H. Tse, “Adaptive Random Testing: The ART of test case diversity,” J. Syst. Softw., vol. 83, no. 1, pp. 60-66, 2010.

Suggestions

’

Unpaired symbol: ‘‘’ seems to be missing

Happy suggestion

[70] S. Sidiroglou-Douskos, S. Misailovic, H. Hoffmann, and M. C. Rinard, “Managing Performance vs. Accuracy Trade-offs With Loop Perforation,” in SIGSOFT/FSE’11 19th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE-19) and ESEC’11: 13th European Software Engineering Conference (ESEC-13), pp. 124-134, 2011.

Suggestions

insert '' by 'Foundations,'

Happy suggestion

[69] K. Pohl, G. Béckle, and F. van der Linden, Software Product Line Engineering - Foundations, Principles, and Techniques. Springer, 2005.

[69] K. Pohl, G. Béckle, and F. van der Linden, Software Product Line Engineering -Foundations, Principles, and Techniques. Springer, 2005.

Suggestions

Foundations,

-Foundations,

replace '-Foundations,' by '-'

[86] S. Crane, A. Homescu, S. Brunthaler, P. Larsen, and M. Franz, “Thwarting Cache Side-channel Attacks Through Dynamic Software Diversity,” in 22nd Annual Network and Distributed System Security Symposium, NDSS 2016, San Diego, California, USA, February 8-11, 2015, The Internet Society, 2015.

Suggestions

diversity,”

Software

replace 'Software' by 'software'

Happy suggestion

Suggestions

software

Dynamic

replace 'Dynamic' by 'dynamic'

Happy suggestion

Suggestions

dynamic

Through

replace 'Through' by 'through'

Happy suggestion

Suggestions

through

Attacks

replace 'Attacks' by 'attacks'

Happy suggestion

Suggestions

attacks

Side-channel

replace 'Side-channel' by 'side-channel'

Happy suggestion

Suggestions

side-channel

Cache

replace 'Cache' by 'cache'

Happy suggestion

Suggestions

cache

’

Unpaired symbol: ‘‘’ seems to be missing

Happy suggestion

[85] K. Pettis and R. C. Hansen, “Profile Guided Code Positioning,” in Proceedings of the ACM SIGPLAN’90 Conference on Programming Language Design and Implementation (PLDI), pp. 16-27, 1990.

Suggestions

abs/2308.03123,

replace 'abs/2308.03123,' by 'Abs/2308.03123,'

Happy suggestion

[96] S. Cao, N. He, Y. Guo, and H. Wang, “WASMixer: Binary Obfuscation for WebAssembly,” CoRR, vol. Abs/2308.03123, 2023.

[96] S. Cao, N. He, Y. Guo, and H. Wang, “WASMixer: Binary Obfuscation for WebAssembly,” CoRR, vol. abs/2308.03123, 2023.

Suggestions

Abs/2308.03123,

abs

This sentence does not start with an uppercase letter.

Happy suggestion

[96] S. Cao, N. He, Y. Guo, and H. Wang, “WASMixer: Binary Obfuscation for WebAssembly,” CoRR, vol. abs/2308.03123, 2023.

Stack

replace 'by' by 'Randomizing'

Happy suggestion

Suggestions

Randomizing

Violations

replace 'Violations' by 'by'

Suggestions

“SaVioR:

replace 'B.' by 'Kang,'

Happy suggestion

Suggestions

Kang,

insert '' by 'B.'

Happy suggestion

Suggestions

The

delete 'The' by ''

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

1997.

replace '1997.' by 'yes.'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

yes.

Zealand,

replace 'Zealand,' by 'is'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

New

replace 'New' by 'answer'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

answer

Auckland,

replace 'Auckland,' by 'The'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

replace 'of' by '1997.'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

1997.

University

replace 'University' by 'Zealand,'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

Zealand,

University

Department

replace 'Department' by 'Science,'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

Science,

rep.,

replace 'rep.,' by 'Computer'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

Computer

tech.

replace 'tech.' by 'of'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

transformations,”

replace 'transformations,”' by 'Department'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

Department

obfuscating

replace 'obfuscating' by 'tech.'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

tech.

replace 'of' by 'transformations,”'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

transformations,”

taxonomy

replace 'taxonomy' by 'obfuscating'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

obfuscating

“A

and

replace 'and' by 'Low,'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

Suggestions

Low,

Thomborson,

replace 'Thomborson,' by 'D.'

Happy suggestion

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. Department of Computer Science, University of Auckland, New Zealand, 1997. The answer is yes.

[97] C. Collberg, C. Thomborson, and D. Low, “A taxonomy of obfuscating transformations,” tech. rep., Department of Computer Science, University of Auckland, New Zealand, 1997. The

abs/2305.14591,

replace 'abs/2305.14591,' by 'Abs/2305.14591,'

Happy suggestion

[106] K. Zhang, D. Wang, J. Xia, W. Y. Wang, and L. Li, “ALGO: Synthesizing Algorithmic Programs with Generated Oracle Verifiers,” CoRR, vol. Abs/2305.14591, 2023.

[106] K. Zhang, D. Wang, J. Xia, W. Y. Wang, and L. Li, “ALGO: Synthesizing Algorithmic Programs with Generated Oracle Verifiers,” CoRR, vol. abs/2305.14591, 2023.

Suggestions

Abs/2305.14591,

abs

This sentence does not start with an uppercase letter.

Happy suggestion

[106] K. Zhang, D. Wang, J. Xia, W. Y. Wang, and L. Li, “ALGO: Synthesizing Algorithmic Programs with Generated Oracle Verifiers,” CoRR, vol. abs/2305.14591, 2023.

Suggestions

sep

replace 'sep' by 'Sep'

Happy suggestion

[103] E. Schulte, Z. P. Fry, E. Fast, W. Weimer, and S. Forrest, “Software mutational robustness,” vol. 15, p. 281-312, Sep 2014.

[103] E. Schulte, Z. P. Fry, E. Fast, W. Weimer, and S. Forrest, “Software mutational robustness,” vol. 15, p. 281-312, sep 2014.

Suggestions

(101]

replace '(101]' by '(101)'

(109] P. M. Phothilimthana, A. Thakur, R. Bodfk, and D. Dhurjati, “Scaling up Superoptimization,” in Proceedings of the Twenty-First International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS, pp. 297-310, 2016.

Suggestions

Integr.

replace 'Integr.' by 'Integrity.'

Happy suggestion

[116] G. Agosta, A. Barenghi, G. Pelosi, and M. Scandale, “The MEET Approach: Securing Cryptographic Embedded Software Against Side Channel Attacks,” IEEE Trans. Comput. Aided Des. Integrity. Circuits Syst., vol. 34, no. 8, pp. 1820-1333, 2015.

[116] G. Agosta, A. Barenghi, G. Pelosi, and M. Scandale, “The MEET Approach: Securing Cryptographic Embedded Software Against Side Channel Attacks,” IEEE Trans. Comput. Aided Des. Integr. Circuits Syst., vol. 34, no. 8, pp. 1820-1333, 2015.

Suggestions

Integrity.

rep.,

delete 'rep.,' by ''

Happy suggestion

[114] B. Salamat, A. Gal, T. Jackson, K. Manivannan, G. Wagner, and M. Franz, “Stopping Buffer Overflow Attacks at Run-Time: Simultaneous Multi-variant Program Execution on a Multicore Processor,” tech. Technical Report 07-13, School of Information and Computer Sciences, UCIrvine, 2007.

[114] B. Salamat, A. Gal, T. Jackson, K. Manivannan, G. Wagner, and M. Franz, “Stopping Buffer Overflow Attacks at Run-Time: Simultaneous Multi-variant Program Execution on a Multicore Processor,” tech. rep., Technical Report 07-13, School of Information and Computer Sciences, UCIrvine, 2007.

Suggestions

441,

delete '441,' by ''

Happy suggestion

[113] D. Bruschi, L. Cavallaro, and A. Lanzi, “Diversified Process Replicee for Defeating Memory Error Exploits,” in Proceedings of the 26th IEEE International Performance Computing and Communications Conference, IPCCC 2007, April 11-18, 2007, New Orleans, Louisiana, USA, pp. 434—441, IEEE Computer Society, 2007.

[113] D. Bruschi, L. Cavallaro, and A. Lanzi, “Diversified Process replicee for Defeating Memory Error Exploits,” in Proceedings of the 26th IEEE International Performance Computing and Communications Conference, IPCCC 2007, April 11-18, 2007, New Orleans, Louisiana, USA, pp. 434— 441, IEEE Computer Society, 2007.

Suggestions

434—

replace '434—' by '434—441,'

Happy suggestion

Suggestions

434—441,

replicee

replace 'replicee' by 'Replicee'

Happy suggestion

Suggestions

Replicee

27:13,

delete '27:13,' by ''

Happy suggestion

[111] V. Singhal, A. A. Pillai, C. Saumya, M. Kulkarni, and A. Machiry, “Cornucopia : A Framework for Feedback Guided Generation of Binaries,” in 87th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022, pp. 27:1—27:13, ACM, 2022.

Suggestions

27:1—

delete '27:1—' by ''

Happy suggestion

Suggestions

pp.

replace 'pp.' by '27:1—27:13,'

Happy suggestion

Suggestions

27:1—27:13,

2022,

replace '2022,' by 'pp.'

Software

replace 'Software' by 'Engineering,'

Happy suggestion

Suggestions

Engineering,

Automated

replace 'Automated' by 'Software'

Happy suggestion

Suggestions

Software

replace 'on' by 'Automated'

Happy suggestion

Suggestions

Automated

Conference

replace 'Conference' by 'on'

Suggestions

IEEE/ACM

replace 'in' by '87th'

Happy suggestion

Suggestions

87th

Binaries,”

replace 'Binaries,”' by 'in'

Happy suggestion

Suggestions

replace 'of' by 'Binaries,”'

Happy suggestion

Suggestions

Binaries,”

Generation

replace 'Generation' by 'of'

Suggestions

replace 'A' by 'Framework'

Happy suggestion

Suggestions

Framework

and

replace 'and' by 'A.'

Suggestions

Pillai,

insert '' by 'A.'

Happy suggestion

Suggestions

abs/2110.03301,

replace 'abs/2110.03301,' by 'Abs/2110.03301,'

Happy suggestion

[124] H. Bostani and V. Moonsamy, “EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection,” CoRR, vol. Abs/2110.03301, 2021.

[124] H. Bostani and V. Moonsamy, “EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection,” CoRR, vol. abs/2110.03301, 2021.

Suggestions

Abs/2110.03301,

abs

This sentence does not start with an uppercase letter.

Happy suggestion

[124] H. Bostani and V. Moonsamy, “EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection,” CoRR, vol. abs/2110.03301, 2021.

Suggestions

abs/2111.11487,

replace 'abs/2111.11487,' by 'Abs/2111.11487,'

Happy suggestion

[135] P. Dasgupta and Z. Osman, “A Comparison of State-of-the-art Techniques for Generating Adversarial Malware Binaries,” CoRR, vol. Abs/2111.11487, 2021.

[135] P. Dasgupta and Z. Osman, “A Comparison of State-of-the-art Techniques for Generating Adversarial Malware Binaries,” CoRR, vol. abs/2111.11487, 2021.

Suggestions

Abs/2111.11487,

abs

This sentence does not start with an uppercase letter.

Happy suggestion

[135] P. Dasgupta and Z. Osman, “A Comparison of State-of-the-art Techniques for Generating Adversarial Malware Binaries,” CoRR, vol. abs/2111.11487, 2021.

Suggestions

How

delete 'How' by ''

Happy suggestion

[130] R. L. Castro, C. Schmitt, and G. D. Rodosek, “How Automatic Malware Modifications Can Evade Static Detection?,” in 2019 5th International Conference on Information Management (ICIM), pp. 20-27, 2019.

[130] R. L. Castro, C. Schmitt, and G. D. Rodosek, “ARMED: How Automatic Malware Modifications Can Evade Static Detection?,” in 2019 5th International Conference on Information Management (ICIM), pp. 20-27, 2019.

Suggestions

“ARMED:

replace '“ARMED:' by '“How'

Happy suggestion

Suggestions

“How

insert '' by 'March'

Happy suggestion

[148] T. Schnitzler, K. Kohls, E. Bitsikas, and C. Pépper, “Hope of Delivery: Extracting User Locations From Mobile Instant Messengers,” in 30th Annual Network and Distributed System Security Symposium, NDSS 2023, San Diego, California, USA, February 27 - March 8, 2023, The Internet Society, 2023.

Suggestions

March

-March

replace '-March' by '-'

Happy suggestion

Suggestions

March 8, 2023

A new year has begun. Did you mean “March 8, 2024”?

Happy suggestion

Suggestions

March 8, 2024

“babble:

replace '“babble:' by '“Babble:'

Happy suggestion

[145] D. Cao, R. Kunkel, C. Nandi, M. Willsey, Z. Tatlock, and N. Polikarpova, “Babble: Learning Better Abstractions with E-Graphs and Anti-unification,” Proc. ACM Program. Lang., vol. 7, no. POPL, pp. 396-424, 2023.

[145] D. Cao, R. Kunkel, C. Nandi, M. Willsey, Z. Tatlock, and N. Polikarpova, “babble: Learning Better Abstractions with E-Graphs and Anti-unification,” Proc. ACM Program. Lang., vol. 7, no. POPL, pp. 396-424, 2023.

Suggestions

“Babble:

CoRR,

replace 'CoRR,' by 'CoRR.'

Happy suggestion

[140] R. Sasnauskas, and J. Regehr, Y. Chen, “Souper: vol. Abs/1711.04422, 2017. P. Collingbourne, J. Ketema, J. Taneja, A Synthesizing Superoptimizer,” CoRR.

[140] R. Sasnauskas, and J. Regehr, Y. Chen, “Souper: vol. abs/1711.04422, 2017. P. Collingbourne, J. Ketema, J. Taneja, A Synthesizing Superoptimizer,” CoRR,

Suggestions

CoRR.

abs/1711.04422,

replace 'abs/1711.04422,' by 'Abs/1711.04422,'

Happy suggestion

[140] R. Sasnauskas, and J. Regehr, Y. Chen, “Souper: vol. Abs/1711.04422, 2017. P. Collingbourne, J. Ketema, J. Taneja, A Synthesizing Superoptimizer,” CoRR.

[140] R. Sasnauskas, and J. Regehr, Y. Chen, “Souper: vol. abs/1711.04422, 2017. P. Collingbourne, J. Ketema, J. Taneja, A Synthesizing Superoptimizer,” CoRR,

Suggestions

Abs/1711.04422,

abs

This sentence does not start with an uppercase letter.

Happy suggestion

[140] R. Sasnauskas, and J. Regehr, Y. Chen, “Souper: vol. abs/1711.04422, 2017. P. Collingbourne, J. Ketema, J. Taneja, A Synthesizing Superoptimizer,” CoRR,

Suggestions

Comput.

replace 'Comput.' by 'Computer.'

Happy suggestion

[150] F. Cohen, “Computer Viruses: Theory and Experiments,” Computer. Secur., vol. 6, no. 1, pp. 22-35, 1987.

[150] F. Cohen, “Computer Viruses: Theory and Experiments,” Comput. Secur., vol. 6, no. 1, pp. 22-35, 1987.

Suggestions

Computer.

Transformations,”

replace 'Transformations,”' by 'transformations,”'

Happy suggestion

[158] W. Zhang, S. Guo, H. Zhang, Y. Sui, Y. Xue, and Y. Xu, “Challenging Machine Learning-based Clone Detectors via semantic-preserving code transformations,” IEEE Trans. Software Eng., vol. 49, no. 5, pp. 3052-3070, 2023.

[158] W. Zhang, S. Guo, H. Zhang, Y. Sui, Y. Xue, and Y. Xu, “Challenging Machine Learning-based Clone Detectors via Semantic-preserving Code Transformations,” IEEE Trans. Software Eng., vol. 49, no. 5, pp. 3052-3070, 2023.

Suggestions

transformations,”

Code

replace 'Code' by 'code'

Happy suggestion

Suggestions

code

Semantic-preserving

replace 'Semantic-preserving' by 'semantic-preserving'

Happy suggestion

Suggestions

semantic-preserving

Diagnostics,”

replace 'Diagnostics,”' by 'diagnostics,”'

Happy suggestion

[157] H. Ye, M. Martinez, X. Luo, T. Zhang, and M. Monperrus, “SelfAPR: Self-supervised program repair with test execution diagnostics,” in 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022, pp. 92:1-92:13, ACM, 2022.

[157] H. Ye, M. Martinez, X. Luo, T. Zhang, and M. Monperrus, “SelfAPR: Self-supervised Program Repair with Test Execution Diagnostics,” in 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022, pp. 92:1-92:13, ACM, 2022.

Suggestions

diagnostics,”

Execution

replace 'Execution' by 'execution'

Happy suggestion

Suggestions

execution

Test

replace 'Test' by 'test'

Happy suggestion

Suggestions

test

Repair

replace 'Repair' by 'repair'

Happy suggestion

Suggestions

repair

Program

replace 'Program' by 'program'

Happy suggestion

Suggestions

program

arXiv:2305.19915,

replace 'arXiv:2305.19915,' by 'ArXiv:2305.19915,'

Happy suggestion

[155] T. Y. Zhuo, Z. Yang, Z. Sun, Y. Wang, L. Li, X. Du, Z. Xing, and D. Lo, “Source Code Data Augmentation for Deep Learning: A Survey,” arXiv e-prints, p. ArXiv:2305.19915, May 2023.

[155] T. Y. Zhuo, Z. Yang, Z. Sun, Y. Wang, L. Li, X. Du, Z. Xing, and D. Lo, “Source Code Data Augmentation for Deep Learning: A Survey,” arXiv e-prints, p. arXiv:2305.19915, May 2023.

Suggestions

ArXiv:2305.19915,

Warnings in 108 pages

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion

Suggestions

Happy suggestion